open-swe/agent/dashboard/eval_jobs.py
Adam Moussa a4ed19ba61
Some checks failed
CI / Lint (push) Waiting to run
CI / Format check (push) Waiting to run
CI / Unit tests (push) Waiting to run
CI / Playwright E2E (push) Waiting to run
Build & publish app artifacts / Publish + deploy (dev) (push) Has been cancelled
Build & publish app artifacts / Publish + deploy (prod) (push) Has been cancelled
Infra CD / Infra CI (pre-deploy) (push) Has been cancelled
Infra CD / Deploy open-swe-dev (push) Has been cancelled
Infra CD / Deploy open-swe-prod (push) Has been cancelled
feat: migrate model providers to Bedrock (Claude) + Fireworks (everything else) (#62)
* feat: switch model providers to AWS Bedrock (Claude) and Fireworks (non-Claude)

Migrate off direct provider APIs: AWS Bedrock for Anthropic/Claude via the
cross-region inference profile us.anthropic.claude-opus-4-8, Fireworks AI for
all non-Claude models. Drop OpenAI (gpt-5.5) and Google (gemini-3.5-flash)
entirely. DEFAULT_MODEL_ID is now Bedrock Claude; all Fireworks models stay
freely selectable for the agent and reviewer graphs and via team/profile
defaults.

- pyproject: add langchain-aws (ChatBedrockConverse + boto3)
- options.py: Bedrock Claude entry + default; remove openai/google entries
- model.py: bedrock_converse provider_model_kwargs (effort -> thinking budget),
  region pin in make_model, bedrock<->fireworks fallback pairing, AWS_REGION/
  FIREWORKS_API_KEY local-dev validation
- server.py: provider-aware fallback kwargs build
- sanitize_thinking_blocks: also sanitize ChatBedrockConverse thinking blocks
- model_fallback: treat transient botocore ClientError codes as fallback-worthy
- eval_jobs: repoint hardcoded eval model id to Bedrock Claude
- tests: repoint dropped model ids; drop obsolete google test module

* fix(bedrock): use adaptive thinking + output_config.effort for Opus 4.8

The handoff spec wired Bedrock Converse thinking as
{type: enabled, budget_tokens: N}, but Opus 4.7+ rejects that with a
ValidationException: thinking.type "enabled" is not supported; it requires
thinking.type "adaptive" plus output_config.effort. Verified by live invoke
against us.anthropic.claude-opus-4-8 (account 328440206208, us-east-1):
the enabled+budget shape 400s, adaptive+effort returns normally.

Map profile effort to additional_model_request_fields:
  {thinking: {type: adaptive, display: summarized},
   output_config: {effort: <low|medium|high|xhigh|max>}}
reusing anthropic_thinking_for/anthropic_effort_for. Update the two
subagent-model tests asserting the old shape.

* fix(deploy): seed Bedrock/Fireworks models, not the dropped anthropic:/openai: ids

Model selection is store-driven, so seed_store.sh's team_settings/default seed is
what runs in prod. It still seeded the removed providers, which would fail at runtime
after the migration:
- agent/builder: anthropic:claude-opus-4-8 -> bedrock_converse:us.anthropic.claude-opus-4-8
- reviewer: openai:gpt-5.5 (dropped) -> bedrock_converse:us.anthropic.claude-opus-4-8
  (set SEED_REVIEWER_MODEL to a Fireworks model for a cross-family reviewer)
- fetch-config REQUIRED_PROVIDER_KEYS default ANTHROPIC_API_KEY,OPENAI_API_KEY ->
  FIREWORKS_API_KEY (Bedrock auths via host IAM role; dropping the old keys would
  otherwise fail-fast at boot)
- docs (DEPLOYMENT/ROTATION/put-config) updated to match.

Surfaced by the cross-family review + verified against deploy/.

* fix(bedrock): security-review NITs — region resolution, error sanitization, reasoning-block strip

From /sh-security-review (all confirmed-low):
- model.py: resolve region from AWS_REGION OR AWS_DEFAULT_REGION (matches
  validate_local_dev_llm_config) so the validated region is the one actually used.
- model_fallback.py: sanitize Bedrock AccessDenied/ResourceNotFound errors to the
  error code only, so the role ARN + account id in the raw botocore message never
  reach logs or the user channel (CWE-209).
- sanitize_thinking_blocks.py: also strip empty Bedrock reasoning_content blocks
  (Converse emits reasoning_content, not thinking) so the middleware is not a no-op
  on Bedrock; + unit tests. (Empty blocks replay fine today; defensive.)

* deploy(bedrock): grant instance-role Bedrock invoke + repoint LLM_MODEL_ID / eval model ids

Deployment-readiness for the Bedrock migration (PR #62):
- instance-role.ts: least-privilege bedrock:InvokeModel[WithResponseStream] on the
  us.anthropic.claude-opus-4-8 inference-profile ARN + the foundation-model ARN in
  each routed region (us-east-1/2, us-west-2). The model runs in the server process
  on the box, so the EC2 instance role is the principal. Simulator-verified (allowed
  for opus-4-8, implicitDeny for other models) and synth-verified. Passed the
  mandatory GPT-4.1 IAM cross-review (no blockers, least-privilege confirmed).
- config-store.ts: IaC SSM LLM_MODEL_ID anthropic:claude-opus-4-8 ->
  bedrock_converse:us.anthropic.claude-opus-4-8. This SSM value overrides
  seed_store.sh's default via pick precedence, so the seed-script fix alone was
  insufficient — both sources now point at the supported Bedrock id.
- infra/README.md + evals/reviewer/config.toml: repoint stale anthropic:/google_genai:
  ids to the Bedrock id (config.toml's model_id was an active, now-broken value).

AWS_REGION is already wired via user-data.sh (IMDS -> boot.env), so no change needed there.

* chore(secrets): drop OPENAI/GOOGLE/GROQ key shells (revoked, providers removed)

Those three providers were dropped in the Bedrock/Fireworks migration and their keys
revoked; the live Secrets Manager objects (open-swe-{dev,prod}/{OPENAI,GOOGLE,GROQ}_API_KEY)
were deleted (7-day recovery). Remove them from the IaC so a future cdk deploy does not
recreate the shells, and from fetch-config's mirror array so boot stops requesting them:
- config-store.ts SECRET_VARS + descriptions (28 -> 25 shells)
- fetch-config.sh SECRET_VARS array (kept in lockstep)
- put-config.sh: drop the put_secret lines; ANTHROPIC_API_KEY re-labelled optional
  (eval judge only — Bedrock builder/reviewer auth via the host IAM role).

REQUIRED_PROVIDER_KEYS is not set in SSM, so it uses the FIREWORKS_API_KEY default.
2026-06-29 15:57:19 -04:00

178 lines
5.3 KiB
Python

"""Track the reviewer eval for the admin dashboard.
The eval itself runs in the ``Reviewer eval`` GitHub Action (durable runner,
isolated from the serving deployment). The Action's harness reports progress
into a LangGraph store record (namespace ``["evals"]``, key ``"reviewer"``) via
``evals.reviewer.store_reporter``; this module reads that record for the
dashboard and reconciles a run whose heartbeat has gone stale (e.g. the Action
was killed) to ``failed``.
"""
from __future__ import annotations
import logging
import os
from datetime import UTC, datetime
from typing import Any, Literal, TypedDict
from langgraph_sdk import get_client
from agent.reviewer_eval_store import (
_HEARTBEAT_STALE_SECONDS,
DEFAULT_EVAL_PROJECT,
EVALS_NAMESPACE,
REVIEWER_EVAL_KEY,
)
logger = logging.getLogger(__name__)
EvalStatus = Literal["idle", "running", "completed", "failed"]
ScoreMode = Literal["all_findings", "surfaced_findings"]
Severity = Literal["low", "medium", "high", "critical"]
class ReviewerEvalConfig(TypedDict):
dataset_name: str
experiment_prefix: str
max_concurrency: int
langsmith_project: str
langgraph_url: str
assistant_id: str
model_id: str
reasoning_effort: str
score_mode: ScoreMode
severity_threshold: Severity
cap: int
DEFAULT_REVIEWER_EVAL_CONFIG: ReviewerEvalConfig = {
"dataset_name": "openswe-reviewer-v1",
"experiment_prefix": "openswe-review-confidence",
"max_concurrency": 5,
"langsmith_project": DEFAULT_EVAL_PROJECT,
"langgraph_url": "",
"assistant_id": "reviewer",
"model_id": "bedrock_converse:us.anthropic.claude-opus-4-8",
"reasoning_effort": "medium",
"score_mode": "all_findings",
"severity_threshold": "medium",
"cap": 4,
}
def _client():
return get_client()
def _now_iso() -> str:
return datetime.now(UTC).isoformat()
def _resolve_langgraph_url() -> str | None:
return os.environ.get("LANGGRAPH_URL") or os.environ.get("LANGGRAPH_URL_PROD")
def _eval_project() -> str:
return os.environ.get("EVAL_LANGSMITH_PROJECT") or DEFAULT_EVAL_PROJECT
def _resolve_eval_config(config: ReviewerEvalConfig | None = None) -> ReviewerEvalConfig:
resolved: ReviewerEvalConfig = {
**DEFAULT_REVIEWER_EVAL_CONFIG,
"langsmith_project": _eval_project(),
"langgraph_url": _resolve_langgraph_url() or "",
}
if config is not None:
resolved.update(config)
return resolved
def _idle_record() -> dict[str, Any]:
config = _resolve_eval_config()
return {
"name": REVIEWER_EVAL_KEY,
"status": "idle",
"run_name": config["experiment_prefix"],
"langsmith_project": config["langsmith_project"],
"limit": None,
"config_snapshot": config,
"started_at": None,
"finished_at": None,
"created_by": None,
"pid": None,
"exit_code": None,
"experiment_url": None,
"error": None,
"log_tail": None,
"worker_id": None,
"heartbeat": None,
"progress": None,
"github_run_url": None,
"trigger": None,
"updated_at": _now_iso(),
}
async def _get_record() -> dict[str, Any] | None:
try:
item = await _client().store.get_item(EVALS_NAMESPACE, REVIEWER_EVAL_KEY)
except Exception as e:
logger.debug("store get_item failed for reviewer eval: %s", e)
return None
if item is None:
return None
value = item.get("value") if isinstance(item, dict) else getattr(item, "value", None)
return value if isinstance(value, dict) else None
async def _put_record(record: dict[str, Any]) -> dict[str, Any]:
record = {**record, "updated_at": _now_iso()}
try:
await _client().store.put_item(EVALS_NAMESPACE, REVIEWER_EVAL_KEY, record)
except Exception:
logger.exception("Failed to persist reviewer eval status")
return record
def _heartbeat_age_seconds(record: dict[str, Any]) -> float | None:
"""Seconds since the record's heartbeat, or ``None`` if absent/unparseable."""
hb = record.get("heartbeat")
if not isinstance(hb, str) or not hb:
return None
try:
ts = datetime.fromisoformat(hb)
except ValueError:
return None
if ts.tzinfo is None:
ts = ts.replace(tzinfo=UTC)
return (datetime.now(UTC) - ts).total_seconds()
def _is_heartbeat_fresh(record: dict[str, Any]) -> bool:
age = _heartbeat_age_seconds(record)
return age is not None and age <= _HEARTBEAT_STALE_SECONDS
async def get_reviewer_eval_status() -> dict[str, Any]:
"""Return the latest reviewer-eval status, reconciling a stale ``running``.
The GitHub Action refreshes the record's heartbeat while it runs. A poll
only marks the run failed once the heartbeat is stale, so a healthy run is
left untouched and a killed Action surfaces as ``failed`` within the stale
threshold.
"""
record = await _get_record()
if record is None:
return _idle_record()
if record.get("status") != "running":
return record
if _is_heartbeat_fresh(record):
return record
return await _put_record(
{
**record,
"status": "failed",
"finished_at": record.get("finished_at") or _now_iso(),
"error": "Eval process is no longer tracked (GitHub Action stopped?).",
}
)