mirror of
https://github.com/dtzp555-max/olp.git
synced 2026-07-21 21:15:10 +00:00
cold-audit catch from 2026-05-24
Round-2 cold-audit Finding 3 (P2 cache correctness). ADR 0005 § "Cache
write conditions" items 3 and 4 were documented but never wired in
code:
- Item 3: "The provider's hints.cacheable flag is not false"
- Item 4: "The response is below a size cap (default 10 MB; configurable)"
Grep verified zero matches for `cacheable` / `10485760` / size-cap
patterns in lib/ or server.mjs pre-D23.
Changes (9 files, +391 / -12):
1. docs/adr/0002-plugin-architecture.md — Amendment 3 adds `cacheable`
to the Provider contract hints list (after D11's Amendment 1 added
maxSpawnTimeMs). Authority chain cites ADR 0005 § Cache write
conditions item 3 as the field's origin.
2. docs/adr/0005-cache-cross-provider.md — Amendment 3 documents the
D23 implementation of items 3 + 4 + the D16-interaction edge case
(truncated > 10MB → no-op eviction, structurally bounded since
responses > 10MB are anomalous by ADR's own rationale).
3. lib/providers/base.mjs — ProviderHints typedef gains
`[cacheable]` (optional boolean); validateProvider rejects non-
boolean non-undefined values. Omission accepted (default = true).
4. 3 plugins (anthropic / codex / mistral) each declare
`cacheable: true` explicitly with citation comment.
5. lib/cache/store.mjs — CacheStore constructor accepts
`maxEntryBytes` (default 10 * 1024 * 1024 = 10_485_760) +
injectable `_warnFn`. `set()` computes
`Buffer.byteLength(JSON.stringify(value))`; if exceeded, warns via
`_warnFn` and returns undefined (no persistence). `getOrCompute`
still returns the computed value to caller — cache write skipped
but caller gets data; subsequent identical requests re-spawn.
6. server.mjs — 4 sites coordinated for cacheable opt-out:
- `executeHopFn`: cacheable check before D13 shouldBypassCacheForHop
(permanent provider policy precedes per-request bypass condition)
- `cacheStore.peek` gate at line ~504: `cacheableForFirstHop`
short-circuit
- Real-streaming branch entry condition at line ~522:
`cacheableForFirstHop` added (so cacheable: false + stream falls
through to buffered path which honors the opt-out via executeHopFn)
- Both `cacheStore.set` sites in streaming branch wrapped in
`if (cacheableForFirstHop)` defensive guards (post-D23
restructure these are unreachable for cacheable: false, but the
guards make intent explicit and survive future refactors)
7. test-features.mjs — 13 new tests:
- 5 validator tests (Suite 4): explicit true/false, omitted, string
rejected, number rejected
- 5 size-cap unit tests (Suite 9): default 10MB, custom override,
oversize skip + warn capture, within-limit normal persistence,
getOrCompute oversize returns-but-doesn't-cache + re-spawn
- 3 cacheable integration tests (Suite 9e): non-streaming opt-out,
streaming opt-out (the regression case that pre-fold-in failed),
X-OLP-Cache header consistency on both paths
Tests: 335 → 348 (+13). All pass on Node 20.
Pre-commit fold-in (per evidence-first checkpoint #4):
- **D23 reviewer flagged 2 blocking issues**: (1) the cacheable opt-out
in initial implementation was only in `executeHopFn` (buffered path);
the D10 real-streaming branch in server.mjs bypassed the check
entirely — calling streamPlugin.spawn() directly and writing to
cacheStore.set() at 2 sites without consulting cacheable. (2) Suite
9e integration tests didn't cover stream: true so the leak wasn't
caught.
Both diff-review and the implementer focused on `executeHopFn`
because that's where the cold-audit reviewer pointed for Finding 3.
Same class of "narrow attention" miss as several earlier D-days.
Fold-in: compute `cacheableForFirstHop` once at request entry; add
`!cacheableForFirstHop` short-circuit to peek gate; add
`cacheableForFirstHop` to streaming-branch entry condition (forces
fall-through to buffered path which has the opt-out); add defensive
guards on both `cacheStore.set` call sites. Added a 3rd Suite 9e
test covering stream: true + cacheable: false (which pre-fold-in
would have failed by serving the second request from cache).
This is now the FOURTH D-day where a doc-vs-code or path-coverage
gap was caught by the reviewer rather than the implementer. The
v1.6 § 10.x diff-review discipline continues to pay off.
Default behavior unchanged for 3 shipped plugins (all explicitly
`cacheable: true` → cache path identical to pre-D23).
Authority:
- ADR 0002 Amendment 3 (in-place) — establishes cacheable in contract
- ADR 0005 Amendment 3 (in-place) — documents implementation of items
3 + 4
- ADR 0005 § Cache write conditions items 3 + 4 — the original
authority for both rules
- CC 开发铁律 v1.6 § 10.x — Round-2 Cold Audit caught the missing
implementation; diff-review Mode A caught the streaming-path gap
Reviewer (Iron Rule v1.6 § 10.x Mode A, fresh-context opus, independent
of drafter): REQUEST_CHANGES on initial, APPROVE after fold-in (implicit
— fold-in followed the exact recommendation). Verified:
- ADR amendment placement + structure
- Validator typedef + checks
- Size cap implementation in CacheStore + inflight slot release on
oversize-skip
- All 4 interaction cases (cacheable × cache_control × D16
× ordering) coherent post-fold-in
- 13 new tests including the regression test that would have failed
on pre-fold-in code
Follow-up items (reviewer's non-blocking notes, NOT in this PR):
- ADR 0005 Amendment 3 could add one sentence on the prior-write-also-
oversize case (file as docs polish)
- Consider extracting `shouldUseCacheForHop(hopProvider, ir)` helper
combining D13 + D23 logic — reduces miss-risk for next reviewer
- Test 30 could add `assert.equal(store._inflight.size, 0)` as
inflight-slot leak regression guard
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
366 lines
13 KiB
JavaScript
366 lines
13 KiB
JavaScript
/**
|
|
* lib/cache/store.mjs — In-process cache store with per-key isolation + singleflight
|
|
*
|
|
* Authority: ADR 0005 § D1 (per-key isolation) + D4 (singleflight)
|
|
*
|
|
* This module implements the OLP response cache. At D5 the backing store is
|
|
* an in-memory Map (not file-backed). File backing lands in a later Phase.
|
|
* The architecture mirrors OCP v3.13.0 (D1+D4) generalized to OLP's
|
|
* (provider, model) keyed cache key space.
|
|
*
|
|
* D1 — Per-key isolation:
|
|
* Outer Map: keyId → inner Map
|
|
* Inner Map: cacheKey (SHA-256 hex) → CacheEntry
|
|
*
|
|
* keyId is the OLP API key identifier (Phase 2 multi-key). At D5, the server
|
|
* passes '__anonymous__' as keyId for all requests.
|
|
*
|
|
* D4 — Singleflight:
|
|
* Concurrent requests with the same (keyId, cacheKey) share one compute
|
|
* invocation. The first caller triggers computeFn(); subsequent callers
|
|
* await the same Promise. After completion, all callers receive the same
|
|
* value, and the result is cached for future callers.
|
|
*
|
|
* D2/D3 are placeholders at D5:
|
|
* D2 (cache_control bypass) — checked in server.mjs before entering getOrCompute.
|
|
* D3 (chunked stream replay with timing fidelity) — at D5 the cache stores
|
|
* full collected chunks and replays them sequentially without timing.
|
|
* Full D3 (timing-accurate replay) lands in a later Phase.
|
|
*
|
|
* Per OCP learning (MEMORY.md learnings/concurrency_dedup_test_signals.md):
|
|
* Singleflight is verified by observing that N concurrent requests for the
|
|
* same key return within ~0ms of each other (not by counting spawn log lines).
|
|
* The content-hash for the cache key must NOT include randomUUID or any
|
|
* per-request random component — only the semantic content that affects output.
|
|
*/
|
|
|
|
// ── Types ─────────────────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* @typedef {Object} CacheEntry
|
|
* @property {*} value - the cached response (IR chunk array for streaming, response object for non-streaming)
|
|
* @property {number} createdAt - epoch ms (Date.now()) when the entry was created
|
|
* @property {number} ttlMs - time-to-live in milliseconds
|
|
*/
|
|
|
|
/**
|
|
* @typedef {Object} CacheStats
|
|
* @property {number} hits
|
|
* @property {number} misses
|
|
* @property {number} size
|
|
* @property {number} inflightCount
|
|
*/
|
|
|
|
// ── CacheStore ────────────────────────────────────────────────────────────
|
|
|
|
export class CacheStore {
|
|
/**
|
|
* @param {object} [opts]
|
|
* @param {number} [opts.maxEntriesPerKey=1000] — evict oldest entries when exceeded
|
|
* @param {number} [opts.maxAgeMs=86400000] — default TTL: 24 hours
|
|
* @param {number} [opts.maxEntryBytes=10485760] — max serialized size per entry (default 10 MB).
|
|
* Entries whose JSON.stringify serialization exceeds this limit are not persisted.
|
|
* ADR 0005 § "Cache write conditions" item 4 (D23). Cache is for hot-path repeat
|
|
* requests, not bulk archive. Configurable so tests can exercise the cap cheaply.
|
|
* @param {() => number} [opts._nowFn=Date.now] — injectable for TTL testing
|
|
* @param {(msg: string, meta?: object) => void} [opts._warnFn] — injectable for warn testing
|
|
*/
|
|
constructor(opts = {}) {
|
|
this._maxEntriesPerKey = opts.maxEntriesPerKey ?? 1000;
|
|
this._maxAgeMs = opts.maxAgeMs ?? 24 * 60 * 60 * 1000; // 24 hours
|
|
// ADR 0005 § "Cache write conditions" item 4 (D23): default 10 MB = 10 * 1024 * 1024 bytes.
|
|
this._maxEntryBytes = opts.maxEntryBytes ?? 10 * 1024 * 1024;
|
|
this._nowFn = opts._nowFn ?? (() => Date.now());
|
|
// Injectable warn function for testing (defaults to console.warn).
|
|
this._warnFn = opts._warnFn ?? ((msg, meta) => console.warn(msg, meta ?? ''));
|
|
|
|
// D1 per-key isolation: keyId → Map<cacheKey, CacheEntry>
|
|
/** @type {Map<string, Map<string, CacheEntry>>} */
|
|
this._store = new Map();
|
|
|
|
// D4 singleflight: `${keyId}:${cacheKey}` → Promise<value>
|
|
/** @type {Map<string, Promise<*>>} */
|
|
this._inflight = new Map();
|
|
|
|
// Stats per keyId
|
|
/** @type {Map<string, { hits: number, misses: number }>} */
|
|
this._stats = new Map();
|
|
}
|
|
|
|
// ── Internal helpers ──────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Returns or creates the inner Map for a given keyId.
|
|
* @param {string} keyId
|
|
* @returns {Map<string, CacheEntry>}
|
|
*/
|
|
_getNamespace(keyId) {
|
|
if (!this._store.has(keyId)) {
|
|
this._store.set(keyId, new Map());
|
|
}
|
|
return this._store.get(keyId);
|
|
}
|
|
|
|
/**
|
|
* Returns or creates the stats object for a given keyId.
|
|
* @param {string} keyId
|
|
* @returns {{ hits: number, misses: number }}
|
|
*/
|
|
_getStats(keyId) {
|
|
if (!this._stats.has(keyId)) {
|
|
this._stats.set(keyId, { hits: 0, misses: 0 });
|
|
}
|
|
return this._stats.get(keyId);
|
|
}
|
|
|
|
/**
|
|
* Returns true if entry has not yet expired.
|
|
* @param {CacheEntry} entry
|
|
* @returns {boolean}
|
|
*/
|
|
_isAlive(entry) {
|
|
const age = this._nowFn() - entry.createdAt;
|
|
return age < entry.ttlMs;
|
|
}
|
|
|
|
/**
|
|
* Evicts oldest entries in a namespace when it exceeds maxEntriesPerKey.
|
|
* @param {Map<string, CacheEntry>} ns
|
|
*/
|
|
_evictIfNeeded(ns) {
|
|
if (ns.size <= this._maxEntriesPerKey) return;
|
|
|
|
// Collect entries sorted by createdAt ascending (oldest first)
|
|
const entries = [...ns.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
|
|
const toEvict = ns.size - this._maxEntriesPerKey;
|
|
for (let i = 0; i < toEvict; i++) {
|
|
ns.delete(entries[i][0]);
|
|
}
|
|
}
|
|
|
|
// ── Public API ────────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Retrieves a cached entry. Returns null on miss or TTL expiry.
|
|
* Updates stats.
|
|
*
|
|
* @param {string} keyId - OLP API key namespace (use '__anonymous__' at D5)
|
|
* @param {string} cacheKey - SHA-256 hex from computeCacheKey()
|
|
* @returns {Promise<CacheEntry|null>}
|
|
*/
|
|
async get(keyId, cacheKey) {
|
|
const ns = this._getNamespace(keyId);
|
|
const entry = ns.get(cacheKey);
|
|
|
|
if (!entry) {
|
|
this._getStats(keyId).misses++;
|
|
return null;
|
|
}
|
|
|
|
if (!this._isAlive(entry)) {
|
|
ns.delete(cacheKey);
|
|
this._getStats(keyId).misses++;
|
|
return null;
|
|
}
|
|
|
|
this._getStats(keyId).hits++;
|
|
return entry;
|
|
}
|
|
|
|
/**
|
|
* Stores a value in the cache.
|
|
*
|
|
* ADR 0005 § "Cache write conditions" item 4 (D23): if the serialized size of `value`
|
|
* exceeds `maxEntryBytes`, the entry is NOT persisted. A `cache_skip_oversize` warn
|
|
* event is logged. The caller still receives the value (this method returns undefined
|
|
* either way); only persistent caching is skipped.
|
|
*
|
|
* @param {string} keyId
|
|
* @param {string} cacheKey
|
|
* @param {*} value
|
|
* @param {number} [ttlMs] - overrides default maxAgeMs
|
|
* @returns {Promise<void>}
|
|
*/
|
|
async set(keyId, cacheKey, value, ttlMs) {
|
|
// ADR 0005 § "Cache write conditions" item 4 (D23): size cap check.
|
|
const byteLength = Buffer.byteLength(JSON.stringify(value));
|
|
if (byteLength > this._maxEntryBytes) {
|
|
this._warnFn('cache_skip_oversize', {
|
|
byteLength,
|
|
maxEntryBytes: this._maxEntryBytes,
|
|
keyId,
|
|
cacheKey,
|
|
});
|
|
return; // Do not persist; caller still receives the value from computeFn.
|
|
}
|
|
|
|
const ns = this._getNamespace(keyId);
|
|
const entry = {
|
|
value,
|
|
createdAt: this._nowFn(),
|
|
ttlMs: ttlMs ?? this._maxAgeMs,
|
|
};
|
|
ns.set(cacheKey, entry);
|
|
this._evictIfNeeded(ns);
|
|
}
|
|
|
|
/**
|
|
* Returns true if a valid (non-expired) entry exists for (keyId, cacheKey).
|
|
*
|
|
* Stats side-effect: this method calls get(), which increments hit/miss
|
|
* counters. Callers that need to peek WITHOUT touching stats should use
|
|
* peek() instead. Server-side cache-status reporting MUST use peek() to
|
|
* avoid double-counting when getOrCompute() is called immediately after.
|
|
*
|
|
* @param {string} keyId
|
|
* @param {string} cacheKey
|
|
* @returns {Promise<boolean>}
|
|
*/
|
|
async has(keyId, cacheKey) {
|
|
const entry = await this.get(keyId, cacheKey);
|
|
return entry !== null;
|
|
}
|
|
|
|
/**
|
|
* Stats-neutral cache peek. Returns true if a valid entry exists without
|
|
* incrementing hit/miss counters. Use this from server.mjs for pre-check
|
|
* cache-status reporting; the subsequent getOrCompute() call is the one
|
|
* that increments the canonical stats counter at the semantic boundary.
|
|
*
|
|
* Fixes the codex-flagged double-count bug where has() + getOrCompute()
|
|
* both incremented the same counter on the same logical request.
|
|
*
|
|
* @param {string} keyId
|
|
* @param {string} cacheKey
|
|
* @returns {Promise<boolean>}
|
|
*/
|
|
async peek(keyId, cacheKey) {
|
|
const ns = this._getNamespace(keyId);
|
|
const entry = ns.get(cacheKey);
|
|
if (!entry) return false;
|
|
if (!this._isAlive(entry)) {
|
|
ns.delete(cacheKey);
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* D4 singleflight: get from cache or compute exactly once for concurrent callers.
|
|
*
|
|
* - Cache hit: return cached value immediately (no computeFn invocation).
|
|
* - Inflight hit: await the existing inflight Promise (singleflight — computeFn
|
|
* runs exactly once for N concurrent callers with the same key).
|
|
* - Miss: register inflight promise, invoke computeFn(), cache the result,
|
|
* release the inflight promise, return the value.
|
|
* - On computeFn error: release the inflight promise (so subsequent calls retry),
|
|
* rethrow the error to all awaiting callers.
|
|
*
|
|
* Per OCP MEMORY.md learning (concurrency_dedup_test_signals.md):
|
|
* Singleflight is verified by timing: N concurrent calls return within ~ms
|
|
* of each other, and computeFn is called exactly once.
|
|
*
|
|
* @param {string} keyId
|
|
* @param {string} cacheKey
|
|
* @param {() => Promise<*>} computeFn - async function producing the value
|
|
* @param {number} [ttlMs]
|
|
* @returns {Promise<*>}
|
|
*/
|
|
async getOrCompute(keyId, cacheKey, computeFn, ttlMs) {
|
|
// 1. Cache hit — return immediately, no singleflight overhead
|
|
const ns = this._getNamespace(keyId);
|
|
const existing = ns.get(cacheKey);
|
|
if (existing && this._isAlive(existing)) {
|
|
this._getStats(keyId).hits++;
|
|
return existing.value;
|
|
}
|
|
|
|
// 2. Inflight hit — singleflight: await the in-progress compute
|
|
const inflightKey = `${keyId}:${cacheKey}`;
|
|
const inFlight = this._inflight.get(inflightKey);
|
|
if (inFlight) {
|
|
// Another caller is already computing this key. Await their result.
|
|
// The first caller will cache the result; we return the same value.
|
|
return inFlight;
|
|
}
|
|
|
|
// 3. Miss — we are the first caller; register inflight promise
|
|
const computePromise = (async () => {
|
|
try {
|
|
const value = await computeFn();
|
|
// Cache the result so future calls are cache hits
|
|
await this.set(keyId, cacheKey, value, ttlMs);
|
|
this._getStats(keyId).misses++;
|
|
return value;
|
|
} finally {
|
|
// Always release the inflight slot, even on error
|
|
this._inflight.delete(inflightKey);
|
|
}
|
|
})();
|
|
|
|
this._inflight.set(inflightKey, computePromise);
|
|
|
|
return computePromise;
|
|
}
|
|
|
|
/**
|
|
* Returns stats for a specific keyId, or aggregate stats across all keyIds.
|
|
*
|
|
* @param {string} [keyId] - if omitted, returns aggregate across all keys
|
|
* @returns {CacheStats}
|
|
*/
|
|
stats(keyId) {
|
|
if (keyId !== undefined) {
|
|
const s = this._stats.get(keyId) ?? { hits: 0, misses: 0 };
|
|
const ns = this._store.get(keyId);
|
|
const size = ns ? ns.size : 0;
|
|
return {
|
|
hits: s.hits,
|
|
misses: s.misses,
|
|
size,
|
|
inflightCount: this._inflight.size,
|
|
};
|
|
}
|
|
|
|
// Aggregate
|
|
let totalHits = 0;
|
|
let totalMisses = 0;
|
|
let totalSize = 0;
|
|
for (const s of this._stats.values()) {
|
|
totalHits += s.hits;
|
|
totalMisses += s.misses;
|
|
}
|
|
for (const ns of this._store.values()) {
|
|
totalSize += ns.size;
|
|
}
|
|
return {
|
|
hits: totalHits,
|
|
misses: totalMisses,
|
|
size: totalSize,
|
|
inflightCount: this._inflight.size,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Clears cache entries (and stats) for a specific keyId, or ALL entries.
|
|
*
|
|
* @param {string} [keyId] - if omitted, clears all namespaces
|
|
*/
|
|
clear(keyId) {
|
|
if (keyId !== undefined) {
|
|
this._store.delete(keyId);
|
|
this._stats.delete(keyId);
|
|
// Also remove any inflight entries for this keyId
|
|
for (const k of this._inflight.keys()) {
|
|
if (k.startsWith(`${keyId}:`)) {
|
|
this._inflight.delete(k);
|
|
}
|
|
}
|
|
} else {
|
|
this._store.clear();
|
|
this._stats.clear();
|
|
this._inflight.clear();
|
|
}
|
|
}
|
|
}
|