KeiSeiKit-1.0/_primitives/_rust/kei-model-router/src/select_kernel.rs
Parfii-bot 187661714f fix(kei-model-router): close 10 audit-blocker findings
Codex CRITICAL + 4 HIGH + 5 MEDIUM/LOW from RULE 0.23 dual-review and
RULE 0.25 multi-critic swarm — all closed.

CRITICAL fix
  - Model::slug() ledger compatibility: posterior.rs + select_kernel.rs
    query `WHERE model = ?2 OR model = ?3`, binding canonical + legacy
    slug pair via new `Model::legacy_slug()`. Production ledger rows
    written under "haiku"/"sonnet"/"opus" remain visible to posterior
    aggregation. Regression test ledger_legacy_slug_counted.

HIGH fixes
  - cmd_select(): no longer early-returns on profile match. Profile's
    default_model_ref now becomes DecisionInput.fallback; select() always
    runs, posterior/kernel evidence wins if present. RULE 0.20 cost
    optimisation restored for all 18 registered agents.
  - Registry pricing SSoT: DecisionInput now carries Option<Arc<Registry>>.
    estimated_cost() tries registry first; hardcoded match is documented
    fallback only. select_posterior.rs no longer duplicates models.toml
    constants.
  - registry.rs portability: include_str!() embeds the three TOMLs at
    compile time. load_embedded() new; disk path tried first via
    KEI_REGISTRIES_DIR, embedded as fallback. `cargo install`d binaries
    now find registries unconditionally. embedded_registry_matches_disk
    test ensures embedded ≡ disk source.
  - next_model() ambiguity: replaced Option<&Model> with EscalationResult
    enum (Next(&Model) / AtTop / NotFound). Callers can distinguish typo
    from ceiling. 5 new tests.

MEDIUM fixes
  - posterior.rs u32 overflow: `(n_plus + n_minus) as u32` →
    `u32::try_from(n_plus.saturating_add(n_minus)).unwrap_or(u32::MAX)`.
    overflow_guard_on_huge_n test with i64::MAX.
  - pick() unknown-model: now returns None when default_model_ref's model
    is absent from registry. Inverted the deprecation guard.
  - HOME unset: disk_registries_dir() returns None on empty HOME and
    falls through to embedded registries. open_ledger() logs warning
    and returns None instead of opening at malformed path.
  - SQLite WAL + busy_timeout: applied to ledger connection in
    open_ledger() — concurrent CLI invocations no longer SQLITE_BUSY.

LOW fixes
  - impl Model consolidation: next_tier() moved to pricing.rs.
    escalate.rs uses current.next_tier() instead of duplicating logic.
  - complexity.rs: removed duplicate "ml-implementer" in HEAVY_ROLES.
  - dna_class.rs: role("") now returns None instead of Some("").

Verification (orchestrator-side, RULE 0.13 §Verify-before-commit):
  - cargo check        → clean
  - cargo test --release → 63 passed / 0 failed (was 58 → +5 new tests
    cover legacy-slug, EscalationResult, overflow, unknown-model, embedded)
  - Constructor Pattern → all files ≤ 200 LOC (max registry.rs 196)
  - Largest fn from_ledger 28 LOC / limit 30

DNA-INDEX.md regenerated by kei-registry hook (cosmetic).

=== STATUS-TRUTH MARKER ===
shipped: functional
stubs: 0
cargo-check: PASS
behaviour-verified: yes
follow-up-required:
  - (none from this commit; next audit pass before merge to main)
2026-05-13 22:09:19 +08:00

76 lines
2.4 KiB
Rust

//! Kernel-smoothed posterior fallback for the empirical selector.
//!
//! When a task-class has no direct ledger entries, borrows posterior mass
//! from neighbouring task-classes weighted by DNA similarity.
//!
//! Constructor Pattern: SQL cube — separated from select.rs to keep both files <200 LOC.
use crate::kernel::{self, KernelWeights};
use crate::posterior::Posterior;
use crate::pricing::Model;
use rusqlite::{Connection, Result as SqlResult};
// Finding 1: accept canonical slug (?2) OR legacy short slug (?3) for
// backward-compat with pre-migration ledger rows.
const QUERY: &str = "SELECT task_class_dna,
SUM(CASE WHEN outcome = 'functional'
AND COALESCE(escalation_depth, 0) = 0
THEN 1 ELSE 0 END) AS np,
SUM(CASE WHEN outcome IS NOT NULL
AND NOT (outcome = 'functional'
AND COALESCE(escalation_depth, 0) = 0)
THEN 1 ELSE 0 END) AS nm
FROM agents
WHERE task_class_dna IS NOT NULL
AND task_class_dna != ?1
AND (model = ?2 OR model = ?3)
GROUP BY task_class_dna";
/// Weighted-sum posterior borrowing from neighbour task-classes.
///
/// Returns a Beta posterior with `alpha`/`beta` inflated by kernel similarity.
/// Starts from a uniform prior (alpha=1, beta=1) and accumulates evidence.
pub fn smooth(
conn: &Connection,
target_task_class: &str,
model: Model,
weights: KernelWeights,
) -> SqlResult<Posterior> {
let mut stmt = conn.prepare(QUERY)?;
let rows = stmt.query_map(
rusqlite::params![target_task_class, model.slug(), model.legacy_slug()],
|r| {
Ok((
r.get::<_, String>(0)?,
r.get::<_, Option<i64>>(1)?.unwrap_or(0),
r.get::<_, Option<i64>>(2)?.unwrap_or(0),
))
},
)?;
accumulate_weighted(rows, target_task_class, weights)
}
fn accumulate_weighted(
rows: impl Iterator<Item = rusqlite::Result<(String, i64, i64)>>,
target: &str,
weights: KernelWeights,
) -> SqlResult<Posterior> {
let mut alpha = 1.0_f64;
let mut beta = 1.0_f64;
let mut n = 0_u32;
for row in rows {
let (other_tc, np, nm) = row?;
let sim = kernel::similarity(target, &other_tc, weights);
if sim <= 0.0 {
continue;
}
alpha += sim * np as f64;
beta += sim * nm as f64;
n = n.saturating_add((np + nm) as u32);
}
Ok(Posterior { alpha, beta, n })
}