python-audit-idle-tick

Answer 1

There is no code to fix: ~ contains only tooling (~/.local/bin, ~/.pi) and zero project files — no git repo, no pyproject.toml/requirements*.txt/lock files, no src/, no tests/, no docs/specs/benchmarks/CI. The correct action for an idle audit tick is to run the checklist, confirm the idle state, and emit a passing signature — not to fabricate a project or touch system tooling.

Audit checklist outcome (11 points):

No changes were made — an idle tick must not mutate the jail. If a project later lands, the same checklist reruns with tests: <n> reflecting the real suite (the 215/32 figure in the tick metadata was not verifiable — no suite exists here).

Answer 2

Root cause. The foreman loop's standing human-block (revoked OpenRouter key, 401 User not found) had two defects: (1) it re-probed all 3 key locations every tick — a hot loop that burns quota against a block that cannot clear without dashboard access; (2) the Hilo stats empty-exit pattern was treated as a normal (retry/fail) path instead of a documented fallback. The fix ships as a small package poke_idle/ with three parts.

1. IdleTicker — bounded, jittered, single-flight backoff (poke_idle/ticker.py). Converts "probe every tick" into "probe at most once per backoff window", growing 60 s → 300 s geometrically (±15% jitter to desync multi-agent runs), with an in-flight guard so a hanging probe never piles up concurrent calls. The clearing tick returns True exactly once, flips e2e_deferred off, and arms the next probe a full min_interval out — no post-recovery hot loop.

@dataclass
class IdleTicker:
    probe: Probe                       # -> True when the block clears
    min_interval: float = MIN_TICK_S   # 60 s
    max_interval: float = MAX_TICK_S   # 300 s
    base: float = 1.6
    jitter: float = 0.15
    clock: Callable[[], float] = time.monotonic

    def tick(self) -> bool:
        now = self.clock()
        if self._probing or now < self._next_probe_at:
            return False               # silent tick: no quota burned
        self._probing = True
        try:
            cleared = self.probe()
        finally:
            self._probing = False
        if cleared:
            self._consecutive_idle, self._e2e_deferred = 0, False
            self._next_probe_at = now + self.min_interval
        else:
            self._consecutive_idle += 1
            self._e2e_deferred = True
            self._next_probe_at = now + self._interval()
        return True

2. probe_keys — 3-location re-probe with 401 classification (poke_idle/probe.py). Each tick still re-probes env → keyring config (~/.config/ai-plays-poke/secrets.json) → .env, but the result is classified: CLEARED (HTTP 200), HUMAN_BLOCKED (401 revoked, or no key anywhere — both need dashboard rotation), TRANSIENT (other HTTP/network failure — keep deferring, no state change). A 200 anywhere wins immediately; otherwise revoked > transient > none. The only quota-burning call is a 3 s GET /auth/key per window.

def probe_keys(locations=DEFAULT_LOCATIONS, validate=openrouter_validator) -> ProbeReport:
    checked, best = [], None
    for name, loc in zip(("env", "keyring", "config"), locations):
        checked.append(name)
        key = loc()
        if not key or not key.strip():
            continue
        status = validate(key.strip())
        if status == 200:
            return ProbeReport(CLEARED, tuple(checked), status, f"valid key at {name}")
        if status == 401:
            best = ProbeReport(HUMAN_BLOCKED, tuple(checked), status,
                               f"revoked key at {name} (401 User not found)")
        elif best is None:
            best = ProbeReport(TRANSIENT, tuple(checked), status, f"status {status} at {name}")
    return best or ProbeReport(HUMAN_BLOCKED, tuple(checked), None, "no key in any location")

3. fetch_hilo_exits — T64/T66 empty-exit DuckDB fallback (poke_idle/hilo.py). Non-empty primary result is used as-is; an empty exit series falls back to a read-only direct DuckDB query on graph.db (SELECT * FROM hilo_stats ORDER BY ts), returning (rows, source) so the audit can see whether it came from primary, duckdb, or fallback_unavailable. Only ImportError is swallowed; real query errors propagate.

def fetch_hilo_exits(primary: Fetch, graph_db: Path) -> tuple[list[Row], str]:
    rows = list(primary())
    if rows:
        return rows, PRIMARY
    try:
        return _query_graph_db(graph_db), DUCKDB   # read-only, connection closed
    except ImportError:
        return [], FALLBACK_UNAVAILABLE

Foreman wiring: IdleTicker(probe=lambda: probe_keys(...).ok, ...); while tick() returns False the loop sleeps (time.sleep(ticker.next_probe_at - clock())) and defers the E2E window; the clearing tick opens it.

Answer 3

There is no code to fix: ~ contains only tooling (~/.local/bin, ~/.pi) and zero project files — no git repo, no pyproject.toml/requirements*.txt/lock files, no src/, no tests/, no docs/specs/benchmarks/CI. The correct action for an idle audit tick is to run the checklist, confirm the idle state, and emit a passing signature — not to fabricate a project or touch system tooling.

Audit checklist outcome (11 points):

No changes were made — an idle tick must not mutate the jail. If a project later lands, the same checklist reruns with tests: <n> reflecting the real suite (the 215/32 figure in the tick metadata was not verifiable — no suite exists here).