Skip to content

Align EngineCore request metadata with batched generation - #9

Open
jakimoai wants to merge 1 commit into
jjang-ai:mainfrom
jakimoai:jack/runtime-add-request-contract
Open

Align EngineCore request metadata with batched generation#9
jakimoai wants to merge 1 commit into
jjang-ai:mainfrom
jakimoai:jack/runtime-add-request-contract

Conversation

@jakimoai

@jakimoai jakimoai commented Jul 11, 2026

Copy link
Copy Markdown

Summary

Aligns EngineCore.add_request with the request metadata already passed by the bundled batched engine. Direct streamed chat now reaches decode instead of failing before generation with an unexpected keyword error.

Problem

Source-built chat requests can load a model successfully and report a healthy engine, then fail before decode when /v1/chat/completions enters the batched generation path.

The failing stream returns a server error:

EngineCore.add_request() got an unexpected keyword argument 'num_messages'

Root Cause

The bundled batched engine caller was updated to pass request metadata such as message count, segment boundaries, cache bypass flags, tokenizer special-token policy, and prompt caps. EngineCore.add_request still had the older signature, so Python rejected those keyword arguments before the scheduler could run.

Fix

  • Accept the metadata kwargs passed by the batched engine.
  • Attach the metadata to the internal request object for scheduler/cache use.
  • Clean up output collector state if scheduler admission raises.
  • Add focused coverage for metadata attachment and rejection cleanup.

Why This Shape

This is deliberately narrow: it restores the contract between two bundled runtime layers without changing the API request shape, launch behavior, UI rendering, or cache policy.

Live Proof

Interface / Harness Model / Config Result
OpenAI-compatible streamed chat MiniMax JANGTQ, batched engine PASS: streamed visible content after the patch
/health after streamed request Same runtime session PASS: scheduler activity and cache-hit counters observed
Focused unit test EngineCore.add_request metadata contract PASS
Adjacent helper unit test hybrid/cache helper coverage PASS

Evidence captured:

  • spawn args: yes, private evidence log
  • startup logs: yes, private evidence log
  • /health: yes, private evidence log
  • streaming chunks/tool calls/reasoning: streamed chat chunks captured; tool calls/reasoning out of scope for this narrow contract fix
  • memory/RAM soak: out of scope; request failed before decode and this PR does not change long-running memory behavior

Regression / Adjacent Coverage

  • Focused metadata contract test covers the exact keyword surface that regressed.
  • Adjacent hybrid/cache helper tests were run because the attached request metadata feeds cache behavior.
  • A direct streamed chat API smoke confirms the scheduler path can run after the signature alignment.

Follow-up / Out of Scope

  • UI streamed-error surfacing is intentionally split into a separate PR.
  • Debug/source app launcher path handling is intentionally split into a separate PR.
  • Cross-adapter streaming coverage is out of scope for this narrow internal contract fix.

Related PRs

Tests

  • python -m unittest ExploitBotEngine/testsuite/test_engine_core_request_metadata_contract.py
  • python -m unittest ExploitBotEngine/testsuite/test_hybrid_ssm_helpers.py
  • python -m py_compile ExploitBotEngine/vmlx_engine/engine_core.py ExploitBotEngine/testsuite/test_engine_core_request_metadata_contract.py
  • Direct streamed /v1/chat/completions smoke against the patched runtime.
  • /health snapshot after decode.

@jakimoai
jakimoai marked this pull request as ready for review July 12, 2026 05:24
jjang-ai pushed a commit that referenced this pull request Jul 14, 2026
Batch resolves the visible pieces of the Codex UX-affordance audit
that were left over from B's handoff. All demo-critical for the 5
conference topics tomorrow (Model Risk Management, Supply Chain,
Compliance Audits, Docs & Auditability, Future-Proofing Compliance).

New shared file: Views/Findings/VulnDetailSheet.swift
  Three reusable sheets so every tab shows finding depth consistently
  instead of eight bespoke layouts:
    - VulnDetailSheet: severity + CVSS + source + CVE + tags +
      description + tool raw-output tail + Send-to-Web/Exploit intents.
    - CVEDetailSheet: everything CVE has (vector, KEV, exploit
      availability, vendor, product, version range, published, sources,
      description, clickable NSWorkspace references) + Search-Metasploit
      intent.
    - ExploitModuleDetailSheet: full metasploit output beyond the
      lineLimit(20) card, with auto-extracted CVE refs and copy.
    - DetailActionButton: consistent pill-button used by all three.

Per-tab wiring
--------------
UX #1  SupplyChainTabView: secrets/deps/SBOM lifecyclePanel now renders
       actual VulnEntry results below the command templates (previously
       command list only, results only visible in Activity Feed). Rows
       open VulnDetailSheet with target/CVE/tags/tool tail.
UX #7  CredsTabView: all 4 subtabs (Cracking, Online Brute, Secrets,
       Vault) — every row is click-to-detail with contextMenu "Open
       details…" mirror. Tooltip on hover.
UX #9  ExploitTabView: metasploit result cards now click through to
       ExploitModuleDetailSheet with full output + detected-CVE
       extraction + copy actions.
UX #12 OSINTTabView: found URLs are now real buttons — click opens in
       browser via NSWorkspace when scheme://, otherwise opens
       OSINTDetailSheet. Context menu adds "Open URL in browser" and
       "Open details…". Non-URL results (e.g., theHarvester emails)
       still land in the detail sheet.
UX #15 ReconTabView: detail sheet gains a "send to next phase" row
       (Web recon / Exploit search / Network scan). Emits a chat-ready
       prompt so autopilot picks up the discovered target without the
       user retyping — moves from find→exploit in one click.
UX #16 SupplyChainTabView: CVE Intel rows open CVEDetailSheet with
       clickable NSWorkspace references, KEV/exploit badges,
       version-range display, source attribution, and
       Search-Metasploit intent.
UX #17 ToolSettingsView: adds error-status summary chip, click-to-
       filter (installed/missing/error), tool-name filter query,
       error rows get "Retry" instead of "Install", tool status dot
       now colored red for .error. Makes the 40+ tool list scannable.
UX #18 TabBarView readiness pill: shows selected-vs-loaded model
       divergence. If engineConfig.modelPath (user's picked model) !=
       engineManager.loadedModel (what the engine actually announced),
       renders in amber with an arrow.left.arrow.right glyph and a
       tooltip explaining the mismatch. Model Risk Management demo
       needs this — "what is answering vs what did I ask for" is the
       whole point of the topic.

Release script (script/package_release.sh)
------------------------------------------
- Default version bumped 0.1.0-beta → 1.0.0. No more "beta" branding.
- DMG output renamed release/ExploitBot-beta.dmg → release/ExploitBot.dmg.
- Volume label renamed "ExploitBot Beta" → "ExploitBot".
- App notarize-zip renamed to plain ExploitBot-app.zip.

Codex adversarial UX-audit findings still open (deferred, non-blocking
for demo):
  #4  ResultProvenance data-contract refactor (largest, structural).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant