Serve diagnostics.findings for ALF's self-diagnosis flow

AF
1h ago
+1840-47

AFT serves diagnostics.findings, the read-only query ALF's fleet self-diagnosis flow calls every 15 minutes (contract: prefrontal tag diagnostics-findings-vectors-v1, vectors vendored with sha256 digests).

What it reports from evidence AFT already keeps, without repairs, polling or executor work: suspended build domains, stuck or blocked jobs and long build-slot waits, language-server start failures, embedding backend down, storage-floor refusals and database open failures, and cleanup failures in the latest retention report. A check that can't be determined reports an error finding, never a healthy one. Replies are severity-ordered and trimmed under 64 KiB like core's.

Who can call it: agent heads and daemon-stamped flows. Worker, run and expired scopes are refused.

Flow scopes: AFT now declares flow-scopes/v1 (BASAL found the daemon refuses flow calls with target_flow_unsupported without it). On AFT's management surface, a route whose scope has a non-empty flow_id can call only diagnostics.findings; every other management op is refused with flow_scope_not_supported before it reads any store. Flow-scoped tool routes are unchanged: they follow the existing call-mode contract (reads served, writes refused). A head's per-call flow read (ephemeral scope, no flow_id) works as before. subc-protocol goes to 0.33.5 for flow_operations.

Summary by cubic

Adds diagnostics.findings, a read-only query AFT serves for ALF's fleet self-diagnosis flow, which calls it every 15 minutes.

  • Suspended build domains, stuck or blocked jobs and long build-slot waits, language-server start failures, embedding backend down, storage-floor refusals, database open failures, and cleanup failures from the latest retention report, all from evidence AFT already keeps.
  • Undetermined checks report error findings, never healthy ones; replies are severity-ordered and trimmed under 64 KiB like core's.
  • Agent heads and daemon-stamped flows can call it; worker, run, and expired scopes are refused.
  • Declares flow-scopes/v1; on management routes a non-empty flow_id scope can call only diagnostics.findings, with other management ops refused as flow_scope_not_supported. Flow-scoped tool routes keep the existing call-mode contract (reads served, writes refused). On cache contention, the query returns an explicit unknown finding instead of probing health.
  • Bumps subc-protocol to 0.33.5 for flow_operations and vendors pinned v1 contract vectors with sha256 digests, plus a search descriptor for the new query.
  • The refusal path overflowed the daemon stack on native Windows; tool dispatch construction and control dispatch are now boxed behind noinline heap factories to keep the protocol poll frame small.