feat: add checkpointed whole-request partitioning outside routing policy

[seonghobae]

Current exact head and delivery boundary

2e7e1d128d13a0e22382ed4081b246f15c47be98 — normal descendant of 86cb73a8d73f3152f253fc6e4433e3f73511d538 and original d797d54db3d2fcc5983425a4b012172409c00b41. Proposed / Draft. No full-repository hosted GREEN, independent approval, immutable release, production runtime or automatic HTTP/reviewer rollout is claimed.

User request: prevent context saturation on large requests such as LineageWeave#983 using both reviewer-local memory and a separate CO whole-request layer. Companion central .github#2068 owns reviewer work state. CO#1119, stacked on #1000, owns separate effort/evaluation repairs. Preserve those ownership boundaries and all predecessor deltas.

Implemented kernel

• Caller-defined semantic units and an effective-payload accounting port; bounded map/reduce preserves every admitted unit without head/tail truncation or arbitrary character slicing. Oversized atomic units require refinement rather than silent loss.
• Separation from existing route/conduct selection and Noema's general agent runtime. The invocation adapter must retain IAM, free/ZDR, Keyverse and provider-routing controls.
• Service-owned SQLite checkpoints with atomic claim/reservation and explicit uncertain-outcome reconciliation. Completed operations can resume without another provider call; unknown accepted calls are not silently replayed.
• Hierarchical reduction with a progress check, output/stop/usage validation, outer call/token reservation and full lineage retained outside growing prompts. Coverage is not semantic correctness or approval.
• Cancellation arriving during the last map/reduce call no longer returns successful completion. Acknowledged results remain checkpointed for authorized resume.

New causal repair: immutable partition replay

Previously _pack recomputed layout on every resume. A changed accounting callback under unchanged request/source/policy/backend identity could regroup already reviewed evidence, generating new operation IDs and submitting it again. The same issue affected reduction packets. Same-layout accounting drift also reused an obsolete reservation.

The current commit seals each ordered map/reduction layout transactionally before dispatch and checks reservation accounting on reuse. Changed layout => checkpoint_partition_changed; changed accounting => checkpoint_accounting_changed; old rows lacking a map manifest => checkpoint_manifest_required, not retrospective attestation. Existing cancellation, budget and uncertain-response behavior remains.

Fresh verification executed on the complete leaf

Original production and both original test files were reconstructed from fetched source and matched their Git blob hashes before execution. No fake replacement implementation was used.

• Exact predecessor, two unchanged test files: 53 passed.
• Initial added regression cases on the unchanged predecessor: 5 failed / 3 passed.
• Current kernel, the original 53 and all 13 new cases: 66 passed with warnings treated as errors.
• Scoped kernel coverage: 185/185 statements and 60/60 branches, no new exclusions.

python3 -m coverage run --branch --source=contextual_orchestrator/request_partitioning \
  -m pytest -q -W error tests/test_request_partitioning.py \
  tests/test_partition_cancellation_fence.py tests/test_partition_checkpoint_layout.py
python3 -m coverage report -m

CPython 3.13.5, pytest 9.0.2. Production blob 495e03431d2c4473bf237c5eff20aebb0fd7b691; new tests 5686fb2129b59d443bd870ff10dfc50a3a3313f5. Test counters are scripted protocol fixtures, not production tokenizers. The 90-unit case proves unit conservation in that fixture, not LineageWeave defect detection. Original 49-test and later four-test evidence remain predecessor history; the 66-case run is the current local evidence.

Runbooks: docs/doctoring/request_partition_replay_20260910.md, docs/doctoring/request_partition_cancellation_20260910.md. Initial design: docs/planning/adrs/2026-09-10-request-partitioning.md.

Remaining acceptance before production

The Python kernel is a Proposed compatibility prototype, not the required Rust operational boundary. Real effective-payload counting for every admitted route; gateway/HTTP continuation; shared inner-worker/retry/race-loser usage reservation; storage authorization/retention; actual host-driven OpenCode, Noema and Strix fresh-session adapters; independent review and exact-head hosted checks; immutable owner release and consumer replay remain open. The root budget currently covers outer invocations only.

The central checked-in OpenCode config denies edit/bash/task and has no MCP server. Merely appending a memory instruction is not executable persistence. Its trusted host must own checkpoint writes and fresh sessions without expanding arbitrary agent privileges. The previous central keyset commit was security-blocked and is not republished by this work.

Research and evaluation

Fugu basic is learned worker selection, not fixed role assignment. Fugu-Ultra/Conductor learns subtask and communication topology; the report distinguishes within-workflow tool-history isolation from cross-workflow memory. Five steps is a training setting, not a root-request/provider/tool-call ceiling. RLM external input access motivates bounded context but transfers no empirical score to CWL.

A future held-out review study must compare baseline / agent-memory / outer-partition / both on unchanged PR snapshots, separating cross-file from source-local defects, false positives, incomplete work and actual usage. Neither synthetic theta construction nor inventory coverage authorizes policy promotion. No paid fallback, new timeout, credential expansion, forced push or gate weakening is introduced.

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4b228bdb-36cc-44e4-9aab-a752380e722d

📥 Commits

Reviewing files that changed from the base of the PR and between 650bb67 and 2e7e1d1.

📒 Files selected for processing (7)

• contextual_orchestrator/request_partitioning/__init__.py
• docs/doctoring/request_partition_cancellation_20260910.md
• docs/doctoring/request_partition_replay_20260910.md
• docs/planning/adrs/2026-09-10-request-partitioning.md
• tests/test_partition_cancellation_fence.py
• tests/test_partition_checkpoint_layout.py
• tests/test_request_partitioning.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Bounded writer continuation for the user's repeated LineageWeave#983 request. Read exact d797d54db3d2fcc5983425a4b012172409c00b41 and reconstructed the complete partitioning module locally; Git blob hash matches 2180508474369c93bb45fc710b0deb21788542d0. No competing source lease was visible in this PR's fetched discussion. Scope: reproduce and repair cancellation/terminal-result boundaries plus evidence/rollout documentation; preserve all initial deltas, no force-push and no protection changes. The prior conversational final report saying no PR was created was incorrect. Prior PR-body test claims are historical claims until independently rerun; new reports will identify exactly which commands were executed. Production rollout still requires Rust-owned runtime, real gateway/token accounting, durable operation admission and all consumer adapters; the Python prototype is not accepted as that runtime.

[seonghobae]

@coderabbitai review

Current continuation head is 86cb73a8d73f3152f253fc6e4433e3f73511d538, a normal descendant of the original #1117 head. The post-checkpoint cancellation fence is repaired; four focused tests pass with warnings treated as errors, changed executable lines 2/2 and branch arcs 2/2. Remote source/test blobs match the local test tree (9852636c... / 2e3e74a5...). See docs/doctoring/request_partition_cancellation_20260910.md.

Correction to inherited verification prose: the earlier 49-test/full-kernel coverage claim was not independently rerun in this continuation. The current evidence is the four new focused cases, not full-repository or hosted GREEN. Automatic HTTP/gateway decomposition, exact live payload counting, inner-call usage admission, Rust runtime migration and OpenCode/Noema/Strix consumer rollout remain open. Do not infer those from the prototype's existence.

Companions: central .github#2068 for reviewer memory, #1119 (stacked on #1000) for empirical-policy authority. Bounded cancellation source writer RELEASED after this publication; no force update, closure, bypass or production default change.

[coderabbitai]

@seonghobae I will review the current changes and the stated cancellation boundary repair.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Continuation scope: repair immutable partition replay on published head 86cb73a8d73f3152f253fc6e4433e3f73511d538, preserving all earlier changes. The complete source and both existing test files were reconstructed from connector reads and match blobs 9852636c..., 0a6e14db..., 2e3e74a5....

Fresh baseline: 53 existing tests PASS. Five new cases reproduce silent regrouping/re-accounting on resume: the same source/policy/backend identity can generate different map/reduction packets and resubmit completed evidence when the accounting callback changes. Local candidate binds each map/reduction layout transactionally before dispatch and rejects changed reservation accounting. Combined 66 tests PASS; scoped kernel coverage is 185/185 statements and 60/60 branches. This is not live model quality or HTTP/reviewer integration evidence.

No other source path, provider policy, paid fallback, timeout or branch protection is changed. Preparing a normal descendant on this same PR; the root budget still covers this adapter's calls only, not all inner Fugu/Conductor calls. The new central finding is separate: the checked-in OpenCode profile has empty MCP and denies edit/bash/task, so its memory instructions cannot be executed by the agent as currently configured. That integration must be implemented by a trusted host adapter without broadening agent privileges.

[seonghobae]

@coderabbitai review

Current exact head 2e7e1d128d13a0e22382ed4081b246f15c47be98 preserves the initial kernel and cancellation fix. The new repair seals ordered map/reduction layouts before invocation and rejects accounting drift on checkpoint reuse. Fresh combined local evidence is 66 passing cases, 185/185 statements and 60/60 branches in this kernel. Review concurrency, legacy missing-manifest behavior, unchanged operation identity and uncertain-provider outcomes; do not infer semantic review quality from coverage.

Current PR-triggered hosted snapshot: Security and Quality 34437396003 is skipped, not passing; SAST 34437395980, Security Scan 34437395989 and CodeQL PR 34437395994 are queued. No bypass, independent approval, deployment or live consumer acceptance is claimed. PR body and the new replay runbook now use the current source identity instead of the predecessor 49-test prose.

Bounded replay source writer RELEASED. Next owner integration is the Rust/runtime and actual gateway/host-session path, with inner usage reservation and source+relationship completeness; the present Python kernel does not complete those requirements.

[coderabbitai]

@seonghobae I will review the current changes. I will focus on checkpoint concurrency, missing-manifest compatibility, operation identity reuse, and uncertain-provider handling.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.