feat: Wire SLA monitor to schedule supervisor

[bernstein-orchestrator]

Closes #4538

Problem

SLA contracts can be created, listed, and reported — and are never evaluated by anything.

Change

fix(spawn): build code context from ranked snippets under a token budget (#4524) (#4574) (eed256d)

• tests/unit/agents/test_spawner_core_helpers.py (+121/-0)
• src/bernstein/core/agents/spawner_core.py (+24/-15)

Also in this branch:

• feat: Wire SLA monitor to schedule supervisor (faefe57)
• feat(server): reject artifact_spec combined with llm_judge at parse time (Declaring llm_judge together with an artifact contract silently routes completion to the wrong verifier #4540) (feat(server): reject artifact_spec combined with llm_judge at parse time (#4540) #4572) (53a1046)
• test(ci): guard required status checks against path-filtered PR triggers (Requiring typecheck-ts contexts before widening its pull_request trigger would wedge every non-TypeScript PR #4557) (test(ci): guard required status checks against path-filtered PR triggers (#4557) #4570) (91e14fc)

Housekeeping, not what this pull request is about:

• style: apply ruff safe fixes and formatting (51cca34)
• feat: Fix lint errors in test files by removing unused imports and organizing import blocks (fbf9a81)
• [WIP] manager-721bc79c partial work (9720b84)
• [WIP] manager-5ba50369 partial work (f593deb)

bernstein.yaml                         | 28 +++++++-----
 tests/unit/test_schedule_supervisor.py | 84 ++++++++++++++++++++++++++++++++++
 2 files changed, 100 insertions(+), 12 deletions(-)

Verification

• Host gate before publish: ruff check + pytest tests/unit/test_schedule_cmd.py tests/unit/test_schedule_supervisor.py - passed.

Provenance

• Diff: sha256:f5264752f2ba7ccc1f66f169546e06b3183f3aed4a40eaffc3b8666ac1b29933
• Journal head: e5a2edb668b13830c525cb7789dcb9ea52c8430bab255dbe477941252f8ad6e7
• Verify: bernstein review-receipt verify --pr <this PR> --issue <issue.md> --diff <pr.diff>

---

Generated from Bernstein session 1787694648.

bernstein-session-id: 1787694648

---

Made by bernstein v3.18.0 - unattended run run-20260825T210342p4043538Z, no operator in the loop.

[bernstein-orchestrator]

VERDICT: request-changes

Blocking Findings

1. Missing deduplication for ongoing SLA breaches (acceptance criteria #2)

File: src/bernstein/core/orchestration/sla_monitor.py (base code, not modified by PR)
Issue: The SLAMonitor.evaluate() method calls build_receipt() for every contract on every tick. build_receipt() returns a new SLAViolationReceipt with tick_instant=now whenever any_breach(verdicts) is true. There is no state tracking to prevent re-emitting receipts for the same ongoing violation episode. Each tick with a persistent breach produces a new receipt with a different receipt_id (which includes tick_instant). The acceptance criteria requires "A breach fires once per violation episode, not once per tick — dedup asserted through consecutive real ticks over unchanged state."

Fix: Add deduplication logic in SLAMonitor to track which contracts have active breaches and only emit a receipt on the first tick of a new violation episode. Persist breach state to disk so it survives restarts.

2. Missing integration test driving tick() with SLA monitor (acceptance criteria #4)

File: tests/unit/test_schedule_supervisor.py
Issue: The acceptance criteria explicitly requires "Test drives the supervisor's real tick() with a monitor over a fixture ledger, not evaluate() called directly." The PR adds test_schedule_cmd.py with basic CLI tests but no test exercises the supervisor's tick() with an SLA monitor over fixture ledger data. The suggested tests from the issue (test_breached_contract_produces_signed_receipt_within_one_tick, test_ongoing_breach_does_not_reemit_every_tick, test_tick_without_contracts_skips_evaluation) are not implemented.

Fix: Add integration tests in test_schedule_supervisor.py that:

• Create a fixture ledger with SLA contract violations
• Construct a ScheduleSupervisor with a real SLAMonitor (using build_monitor_from_sdd on a temp .sdd dir)
• Call tick() and verify signed breach receipts are produced
• Call tick() again with unchanged state and verify no duplicate receipts

3. Missing release notes fragment

Rule: "A user-visible change -- new CLI surface, changed output, a security property, a removal -- without a fragment IS a blocking finding."
Issue: Wiring the SLA monitor to bernstein schedule run is a user-visible change (enables automatic SLA evaluation). No fragment exists under docs/release-notes/fragments/ for issue #4538 or #4579.

Fix: Create docs/release-notes/fragments/4538-sla-monitor-wired-to-schedule.md with a brief description of the change.

Non-Blocking Observations (Nits)

4. Broad exception handling in CLI wiring

File: src/bernstein/cli/commands/schedule_cmd.py:458-466
Issue: The try/except Exception around build_monitor_from_sdd catches all exceptions and only logs a warning. This could mask configuration errors (e.g., corrupted signing keys, permission issues on .sdd/identity). Consider catching more specific exceptions or at least logging the exception type.

5. Test file formatting changes are drive-by

File: tests/unit/test_schedule_supervisor.py
Issue: The diff shows only blank line removals (no functional changes). While harmless, these are unrelated to the PR's stated purpose and should be in a separate formatting commit per repo conventions.

What the PR Does Correctly

• Wires build_monitor_from_sdd(sdd) into schedule_run command
• Passes sla_monitor to ScheduleSupervisor constructor
• Defensive error handling with warning message if monitor unavailable
• Existing ScheduleSupervisor._evaluate_sla_contracts (already in base) correctly calls monitor.evaluate(now_epoch) on each tick
• No contracts = early return in _evaluate_sla_contracts (cheap existence check)
• Ruff and pytest pass for modified files

---

Made by bernstein v3.18.0 - unattended review run run-20260825T233024p350074Z, no operator in the loop.
Signed review receipt: diff_hash sha256:e72f96bd2dd8048ee80ee7bcd7d0a1a2de3427de9174146a32c797d6afc890fc journal_entry_hash sha256:3aa595c4b6d9a7b3246727fab287e2ae7c1dd4f80b964d5bdd1c0f2fbe8810df
(verify with bernstein review-receipt verify)

[bernstein-orchestrator]

VERDICT: request-changes

src/bernstein/core/orchestration/sla_monitor.py:158 — Missing deduplication for ongoing SLA breaches (Finding #1): SLAMonitor.evaluate() emits a new receipt on each tick for persistent breach; no state tracking to prevent re-emitting for same violation episode.

tests/unit/test_schedule_supervisor.py — Missing integration test driving supervisor's tick() with SLA monitor over fixture ledger (Finding #2): No test exercises ScheduleSupervisor.tick() with real SLAMonitor (build_monitor_from_sdd) against fixture ledger data; tests only call monitor.evaluate() directly or use mock monitor.

---

Made by bernstein v3.18.0 - unattended review run run-20260826T002809p514861Z, no operator in the loop.
Signed review receipt: diff_hash sha256:44262ff19e6b45c26d5fc4eb352fbd2b874aca6fccbb27602bd28d756a5cd28a journal_entry_hash sha256:0fa13bf48f63da0796bbb77bbca1cba7578f9bb4a66adb6b24d2c3c404fc8e49
(verify with bernstein review-receipt verify)