foreman/progress.md

foreman — progress

Phase 1: Scaffold — 2026-05-23

• Go module initialized (gitea.stevedudenhoeffer.com/steve/foreman)
• Project layout: cmd/foreman/, internal/config/, internal/store/, internal/server/
• internal/config: loads all FOREMAN_* env vars with defaults and validation
• internal/store: SQLite-backed durable queue (WAL mode, modernc.org/sqlite)
  • jobs table: ULID PK, model, payload, state machine, retry tracking, timestamps
  • artifacts table: named typed blobs per job, unique on (job_id, name)
  • Full CRUD: CreateJob, GetJob, UpdateJobState, ListJobs, CreateArtifact, GetArtifact, GetArtifactsByJob
• internal/server: stdlib net/http server
  • GET /healthz returning {"status":"ok","degraded":false}
  • Optional bearer-token auth middleware (skips /healthz)
• cmd/foreman/main.go: subcommand dispatch (serve + stubs for submit, jobs, ps)
• CI: .gitea/workflows/ci.yaml (build, vet, test -race, tidy check)
• Dockerfile: multi-stage distroless build
• Config files: .env.example, .gitignore
• Tests: config validation, store CRUD + edge cases, server health + auth middleware

Phase 2: Ollama target client, model poller, native passthrough — 2026-05-23

• internal/ollama/ — target client package:
  • Wire types (types.go): ChatRequest/Response, EmbedRequest/Response, TagsResponse, PsResponse, ModelInfo, RunningModel — matching Ollama's native JSON API exactly. Polymorphic fields (think, keep_alive, tools, options) use json.RawMessage for transparent passthrough fidelity.
  • Client interface (client.go): Chat (stream/non-stream), Embed, Tags, Ps, RawChat, RawEmbed. RawChat/RawEmbed return *http.Response for zero-copy streaming passthrough.
  • httpClient implementation: auth token injection, NDJSON streaming via bufio.Scanner with 4 MB buffer, connection vs HTTP error classification.
  • Custom error types (errors.go): *ConnectionError for network failures (retry-eligible), *HTTPError for non-2xx responses. errors.Is/errors.As compatible.
  • ModelInventory (inventory.go): mutex-protected in-memory cache of installed and running models. Methods: Models(), HasModel(), ResidentModels(), LastPoll(), Degraded(), Refresh(). Background Start() goroutine polls at FOREMAN_POLL_INTERVAL (default 30s). On target unreachable: retains last-known inventory, sets degraded=true. Clears degraded on recovery.
• internal/server/ — new Ollama passthrough routes:
  • GET /api/tags — serves poller's cached model list
  • GET /api/ps — serves poller's cached running models
  • POST /api/embed, POST /api/embeddings — direct concurrent proxy to target, bypasses the chat gate entirely (ADR-0013)
  • POST /api/chat — critical path: validates model (re-poll on miss, 404 if still absent), serializes through a capacity-1 channel gate, proxies to target with NDJSON streaming (application/x-ndjson, flushed per chunk) or non-streaming JSON passthrough
  • GET /healthz — now wired to inventory.Degraded() for real target status
• cmd/foreman/main.go — full serve wiring:
  • Creates Ollama client, starts model poller goroutine, warms embedder (keep_alive: -1), creates server with all dependencies, signal-based graceful shutdown via context.NotifyContext
• Tests (all passing with -race):
  • Client: tags/ps parsing, chat streaming + non-streaming, embed, auth token forwarding, *ConnectionError on unreachable target, *HTTPError on non-2xx
  • Inventory: refresh populates models, degraded on failure, model retention, recovery from degraded, Start/cancel lifecycle
  • Server: tags/ps passthrough, model validation (404 on unknown), non-streaming chat proxy, NDJSON streaming passthrough with correct Content-Type, chat serialization (gate holds concurrent requests to max 1 in-flight), concurrent embed bypass (multiple requests run in parallel), degraded health endpoint, embeddings alias path

The Mac is now usable as a go-llm target through foreman: llm.OllamaCloud(token, WithBaseURL("http://foreman:8080")) works transparently for chat (streaming + non-streaming), tags, ps, and embeddings.

Phase 3: Durable queue, single worker, drain-by-model — 2026-05-23

M0 complete. The Phase 2 in-flight chat gate (buffered channel) is replaced with the real SQLite-backed job queue and single worker loop.

• internal/store/ — new store methods:

  • NextJob(currentModel): drain-by-model ordering — prefers jobs matching the currently-resident model to minimize swap cost, then FIFO by created_at.
  • IncrementAttempt(id): bumps attempt counter and re-queues for retry.
  • ResetInterruptedJobs(): resets loading/working jobs to queued on startup (crash recovery).
  • DeleteTerminalJobsBefore(cutoff): TTL pruner for old done/failed jobs.
  • SQLite DSN now includes _pragma=busy_timeout(5000) for reliable concurrent access from HTTP handlers + worker.

• internal/worker/ — single worker loop (worker.go):

  • Worker.Run(ctx): main goroutine loop — resets interrupted jobs on startup, then continuously picks the next job using drain-by-model ordering, executes via the Ollama client, stores result + completion artifact, notifies waiters.
  • Worker.Wake(): non-blocking signal for new job availability.
  • Notifier: sync.Map-based completion notification — HTTP handlers register a channel per job ID, the worker closes it on completion. Supports Register(), Complete(), Result().
  • Retry semantics: *ollama.ConnectionError causes re-queue with incremented attempt; *ollama.HTTPError is a terminal failure (no retry). Max attempts configurable via FOREMAN_MAX_ATTEMPTS (default 3).
  • The worker loop never panics — all errors are logged, jobs are marked, loop continues.

• internal/server/ — chat handler rewrite:

  • POST /api/chat now creates a job row (state queued), registers a completion waiter, wakes the worker, and blocks until the job reaches a terminal state. Returns the Ollama response on success, 502 on failure.
  • ULID job IDs generated at submission time (github.com/oklog/ulid/v2).
  • The old chatGate (buffered channel) is removed entirely.
  • /api/embed and /api/embeddings remain direct concurrent proxies (unchanged from Phase 2, per ADR-0013).

• internal/config/ — new config fields:

  • FOREMAN_MAX_ATTEMPTS (int, default 3)
  • FOREMAN_JOB_TTL (duration, default 24h)

• Tests (all passing with -race):

  • Worker: single job execution, serial enforcement, drain-by-model ordering, retry on connection error, max attempts exhaustion, HTTP error terminal failure, interrupted job reset on startup, wake signal, notifier lifecycle.
  • Store: NextJob drain-by-model, empty queue, IncrementAttempt, ResetInterrupted, DeleteTerminalJobsBefore.
  • Server: chat model validation (404), non-streaming chat through queue, serialization (max 1 concurrent), context cancellation, embed bypass unchanged.

Phase 4: Async /jobs surface, webhooks, artifacts — 2026-05-23

M1 core complete (minus CLI and go-llm constructor, which are separate work).

• internal/webhook/ — webhook dispatcher:

  • Dispatcher.Fire(url, event): non-blocking goroutine delivery with exponential backoff retry (1s, 2s, 4s, 8s, 16s — max 5 attempts).
  • Optional HMAC-SHA256 signing via FOREMAN_WEBHOOK_SECRET — sets X-Foreman-Signature: sha256=<hex> header.
  • VerifySignature(): exported for webhook receivers.
  • FormatArtifacts(): inline (data field) for artifacts <= 256KB, URL reference for larger ones.
  • Webhook failures are logged and dropped — never block or fail the job (ADR-0005).

• internal/server/ — new routes:

  • POST /jobs: validates model, creates job row with optional state_webhook_url, returns 202 Accepted with {"job_id":"<ulid>"}. Fires initial "queued" webhook. Wakes worker.
  • GET /jobs/{id}: returns full job state, result, error, and artifact metadata. 404 for unknown IDs. Artifacts under 256KB are inlined; larger ones get a URL reference.
  • GET /jobs/{id}/artifacts/{name}: serves raw artifact data with stored content type. 404 for unknown job/artifact.

• docs/adr/0014-no-webhooks-on-sync-chat.md:

  • state_webhook_url is only honored on POST /jobs. Sync /api/chat does not fire webhooks (ADR-0014). Rationale: the caller already holds a blocking HTTP connection.

• cmd/foreman/main.go — full serve wiring:

  • Creates webhook dispatcher, notifier, worker.
  • Starts worker loop goroutine and TTL pruner goroutine.
  • TTL pruner runs every jobTTL/4 (min 1 minute), deletes terminal jobs older than FOREMAN_JOB_TTL (default 24h).
  • Server constructor now receives notifier, worker, and dispatcher.

• Tests (all passing with -race):

  • Jobs API: 202 on submit, ULID format, 404 for unknown model, 400 for missing model, 404 for unknown job, job state after completion, artifact retrieval, artifact 404.
  • Webhooks: full lifecycle events (queued->working->done), 500-returning receiver does not affect job state, HMAC signature verification.
  • Webhook dispatcher: delivery, retry on 500, non-blocking Fire, HMAC signing, no HMAC when no secret, signature format validation.
  • Artifacts: small inline, large by URL, empty returns nil.
  • TTL pruner: deletes old terminal jobs.