lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add scheduler related projects

Browse source
This commit is contained in:
Rongsong Shen 2026-07-31 17:42:13 +08:00
parent 986474eb65
commit 5e8a20178b
12 changed files with 3602 additions and 265 deletions
Download patch file Download diff file Expand all files Collapse all files

398
.kiro/specs/scheduler-framework/brief.md
View file

@ -2,13 +2,14 @@
## Problem
The XCE scheduler has a plugin architecture but critical gaps prevent it from being a real framework:
1. **Job selection policy is hardcoded** — `sched_job_picker()` in `scheduler.c:39` uses the literal string `"xce_sched_fcfs"`. No way to swap policies without recompilation. The picker is monolithic — it both chooses which queue to serve and which job within the queue.
1. **Job selection policy is hardcoded** — `sched_job_picker()` in `scheduler.c:39` uses the literal string `"xce_sched_fcfs"`. The picker runs in a dedicated thread with `jbuf` cbuf communication. No way to swap policies without recompilation.
2. **Parallel job allocation is a stub** — `parjob_allocator.c:my_alloc()` returns 0 with no logic. Jobs requiring multiple slots (`maxTasks > 1`) produce no allocation.
3. **Allocation is one-shot** — `sched_make_allocation()` tries the first matching host and stops. No mechanism to try alternative allocation plans (different host×slot combinations) when the first fails.
4. **No preemption** — when a high-priority job cannot be scheduled due to insufficient free resources, there is no mechanism to preempt lower-priority running jobs to free resources.
5. **No project-level scheduling** — `xce_sched_project_t` is just `{ char* name }`. Projects have no resource ownership, quota, or scheduling policy. Queue and project roles are conflated.
5. **No project-level scheduling** — `xce_sched_project_t` is just `{ char* name }`. Projects have no resource ownership, quota, or scheduling policy.
6. **Monolithic scheduler** — the scheduler is tightly coupled to controller I/O (capnp, `apictx`). No way to replay recorded events for debugging or test scheduling policies without a live cluster.
Operators need configurable scheduling policies at multiple levels, parallel job support, and preemption. The scheduler must generate multiple candidate allocation plans and try them in preference order.
Operators need configurable scheduling policies, parallel job support, preemption, and a way to debug/tune scheduling behavior without a live cluster.
## Current State
@ -21,36 +22,49 @@ Operators need configurable scheduling policies at multiple levels, parallel job
- **Select expression AST** (`resreq.h`): full parser/evaluator with per-session memoization (`select_eval_ctx_t`) and inter-session GC.
- **Shared resources** (`xce_scheduler_t.sharedInst`/`sharedInUse`): zarray of resource values tracked per scheduling session.
- **Scheduling loop** (`scheduler.c:sched_allocator()`): pick job → `sched_make_allocation()` → pend or dispatch → next.
- **Controller integration** (`handler.c`): receives capnp push/notify → enqueues `xce_sched_update_request_t` → `sched_update()` dequeues. Decisions published via `sched->apictx`.
### What's missing
- Configurable job picker: the plugin name is a hardcoded string literal; a monolithic picker conflates inter-queue and intra-queue selection
- Configurable job picker: the plugin name is a hardcoded string literal
- Parallel job allocation: no combinatorial plan generation, no multi-slot host matching
- Iterator/lazy generation: allocation is eager one-shot, no retry with alternative plans
- Preemption: no mechanism to preempt lower-priority running jobs when a high-priority job cannot be scheduled
- Project-level scheduling: `xce_sched_project_t` is just `{ char* name }` — no resource ownership, quota, or scheduling policy
- Preemption: no mechanism to preempt lower-priority running jobs
- Project-level scheduling: `xce_sched_project_t` is just `{ char* name }`
- Cross-job resreq optimization: no mechanism to skip already-failed resreq patterns within a session
- Picker composition: no way to assign different pickers to different queues or projects
- Scheduler simulation/debugging: no way to replay recorded events, no virtual clock, no deterministic mode
- Core/driver separation: scheduling logic is tightly coupled to controller I/O
## Desired Outcome
### Four-Level Scheduling Architecture
### Three Architectural Foundations
The scheduling loop is always `project → queue → job`, composing pickers at each level:
**1. Pluggable Job Picker** — the core scheduling loop calls `picker->next_job()` to get the next schedulable job, with zero knowledge of how jobs are selected. The default `builtin_fcfs` picker internally implements queue-priority ordering and FCFS job ordering, replicating today's behavior exactly. Per-queue picker overrides are supported. The picker runs synchronously in the core's scheduling thread — no dedicated picker thread, no `jbuf` cbuf.
| Level | Picker | Plugin slot | Default (v1) |
|-------|--------|-------------|---------------|
| 0 | Project picker | `sched->project_pick_plugin` | `builtin_flat` — single "default" project |
| 1 | Inter-queue picker | `sched->queue_pick_plugin` | `builtin_strict_priority` |
| 2 | Intra-queue picker | `queue→project→sched` chain | `builtin_fcfs` |
| 3 | Preemption policy | `queue->preempt_policy` | `lowest_priority_first` |
The picker plugin interface (`xce_job_picker_iface_t`):
1. **Unified picker loop**: A single scheduling loop that always follows `project → queue → job`. In v1 (flat project space), the project picker `builtin_flat` yields one "default" project containing all queues — identical to today's behavior. In v2 (future), the project picker becomes quota-aware and hierarchical, without changing the loop code.
2. **Configurable job selection at every level**: each picker slot is a plugin. Level 1 (inter-queue) picks which queue to serve next. Level 2 (intra-queue) picks which job within that queue, with per-queue customization via the `queue → project → global` precedence chain.
3. **Lazy allocation plan iterator**: `xce_alloc_plan_iter_t` — generates candidate (nhosts, slots_per_host) plans one at a time, sorted by preference. Consumer tries each plan until one succeeds or all fail.
4. **Lazy host candidate iterator**: for a given allocation plan, iterate candidate hosts filtered by select expression + resource availability. Composes with plan iterator.
5. **Parallel job combinatorial allocation**: `parjob_allocator` implements the plan iterator. For a job needing N slots: generate plans [1host×N, 2hosts×⌈N/2⌉, …, Nhhosts×1]. Each plan: collect hosts with enough slots, try each until success.
6. **Preemption**: when allocation fails for a high-priority job, select victim jobs from lower-priority queues (LSF-style per-queue `preemptible_queues` list), send SIGSTP via controller→worker pipeline, and retry allocation next round.
7. **Session-level unsatisfiable resreq cache**: if a primary resreq cannot be satisfied in the current scheduling session (all plans + preemption exhausted), fingerprint it. Skip subsequent jobs with the same fingerprint for the rest of the session.
| Category | Hooks | Purpose |
|----------|-------|---------|
| Lifecycle | `init`, `fini` | Setup and teardown |
| State-change | `on_queue_update`, `on_job_push`, `on_job_state_change`, `on_job_update` | Called by core when events arrive from driver |
| Session | `begin_session`, `next_job`, `end_session` | Scheduling round lifecycle |
| Post-allocation | `on_dispatch`, `on_pend` | Notification after allocation attempt |
| Optional | `on_config`, `on_job_rusage` | Advanced pickers (NULL if unused) |
**2. Iterator-Driven Allocation** — lazy `xce_alloc_plan_iter_t` (candidate (nhosts, slots_per_host) plans, most-preferred first) composed with lazy `xce_host_iter_t` (candidate hosts for a given plan). `parjob_allocator` implements real combinatorial multi-slot allocation. Session-level unsatisfiable resreq fingerprint cache avoids re-evaluating already-proven-unsatisfiable resreqs.
**3. Core/Driver Separation** — the scheduler core is a passive, event-driven engine with zero controller I/O dependencies. The driver connects it to the outside world:
| Mode | Driver | Input | Output |
|------|--------|-------|--------|
| Normal | Controller-connected | capnp push/notify → core events | Core decisions → controller |
| Simulation | Replay file | JSONL event file → core events | Core decisions → log (with `--sim-verify` diff against recorded) |
- **Discrete event-driven virtual clock**: jumps directly to next event timestamp, no fixed tick, monotonic
- **Snapshot + delta replay**: load state snapshot, replay only subsequent delta events
- **Deterministic guarantee**: same initial state + same events = same decisions
- **Runtime recording control**: xceadmin `scheduler record start/stop` commands
- **JSONL replay format**: one event per line, debuggable, plain text
- **What-if branching**: load snapshot, replay alternative delta events
### Queue vs Project — Roles
@ -59,10 +73,10 @@ The scheduling loop is always `project → queue → job`, composing pickers at
| **Role** | Scheduling mechanism | Resource ownership |
| **Question** | HOW are jobs ordered and constrained? | WHO owns resources and gets charged? |
| **Scope** | One hardware/scheduling profile | Cross-queue, cross-cluster |
| **Key attributes** | Priority, limits, time windows, picker, preemption config | Quota, usage, hierarchy, members (future) |
| **Key attributes** | Priority, limits, time windows, per-queue picker override, preemption config | Quota, usage, hierarchy, members (future) |
| **Cardinality** | 1 job → 1 queue, many-to-many | 1 job → 1 project, many-to-many |
One project submits to many queues (different hardware profiles). One queue receives from many projects (shared hardware).
One project submits to many queues (different hardware profiles). One queue receives from many projects (shared hardware). The picker plugin may use `queue->project_name` internally for project-scoped iteration (v2).
## Alternatives Considered
@ -71,237 +85,267 @@ One project submits to many queues (different hardware profiles). One queue rece
| Aspect | Detail |
|--------|--------|
| **Job selection** | Add `job_pick_plugin` config field, same as chosen approach |
| **Parallel jobs** | Implement parjob allocator with pre-computed plan list. Eager generation — all plans materialized before first try |
| **Iterator** | No new abstraction. Simple for-loop over plan array, inner for-loop over hosts |
| **Shared resreq** | `xlist_t unsatisfiable_resreqs` in session state, same as chosen approach |
| **Parallel jobs** | Implement parjob allocator with pre-computed plan list. Eager generation |
| **Iterator** | No new abstraction. Simple for-loop over plan array |
| **Shared resreq** | `xlist_t unsatisfiable_resreqs` in session state |
**Rejected because:** Eager plan generation causes memory pressure for large combinatorial spaces (e.g., 64 slots on 128 hosts = thousands of plans). No reusable abstraction — each new allocator reimplements the loop. Short-term win, long-term rework cost.
**Rejected because:** Eager plan generation causes memory pressure for large combinatorial spaces. No reusable abstraction — each new allocator reimplements the loop. Short-term win, long-term rework cost.
### Approach B: Iterator-Driven Allocation Architecture ★ Chosen
### Approach B: Iterator-Driven Allocation + Picker Plugin ★ Chosen
| Aspect | Detail |
|--------|--------|
| **Job selection** | Configurable plugin name via `job_pick_plugin` field |
| **Job selection** | Pluggable `xce_job_picker_iface_t` with `next_job()`. Single `builtin_fcfs` default. Per-queue picker override. Synchronous, no dedicated thread. |
| **Iterator abstraction** | `xce_alloc_plan_iter_t` + `xce_host_iter_t` — lazy, cancel-safe, composable |
| **Parallel jobs** | Combinatorial plan generation via plan iterator: 1host×N → 2hosts×⌈N/2⌉ → … → Nhhosts×1 |
| **Host iterator** | Per-plan lazy candidate host iteration using existing select expression eval |
| **Preemption** | `XCE_DECISION_PREEMPT` decision type, LSF-style cross-queue victim selection, SIGSTP via controller→worker |
| **Shared resreq** | Session-level fingerprint cache: `{select, rusage, user, queue, project}` |
| **Core/driver split** | Passive event-driven core + dual-mode driver (normal/simulation) |
| **Simulation** | JSONL replay, snapshot + delta, discrete event-driven virtual clock, deterministic |
**Chosen because:** Lazy generation avoids memory pressure. Iterator composition matches the user's vision: plan iterator → host iterator → try alloc. Clean separation of concerns. Each iterator implementation is independently testable.
**Chosen because:** Lazy generation avoids memory pressure. Single `next_job()` interface makes pickers truly pluggable — the core loop never changes. Core/driver separation enables simulation mode for debugging/tuning without a live cluster. Iterator composition matches the user's vision: plan iterator → host iterator → try alloc.
### Approach C: Full Scheduler Framework (deferred)
| Aspect | Detail |
|--------|--------|
| **Job selection** | Policy chain — multiple plugins score/veto jobs. Composable: priority + fair-share + preemption |
| **Job selection** | Policy chain — multiple plugins score/veto jobs |
| **Iterator** | Triple composition: job iterator → plan iterator → host iterator |
| **Resreq registry** | Named primary resreqs registered globally, referenced by name, reference-counted |
| **Allocation plugins** | Different strategies as plugins: greedy, bin-packing, round-robin, topology-aware |
| **Session state machine** | Formalized STAGING → ELECT → ALLOCATE → COMMIT with well-defined transitions |
| **Resreq registry** | Named primary resreqs registered globally, reference-counted |
| **Allocation plugins** | Different strategies as plugins: greedy, bin-packing, round-robin |
| **Session state machine** | Formalized STAGING → ELECT → ALLOCATE → COMMIT |
**Deferred (not rejected):** The policy chain and resreq registry are valuable but lack current demand. Approach B's iterator abstraction is designed to compose upward — the plan iterator and host iterator are building blocks that a future job iterator or policy chain can consume. The template registry can layer on top without breaking the iterator interfaces.
**Deferred (not rejected):** The policy chain and resreq registry are valuable but lack current demand. Approach B's picker interface is designed to compose upward — a future policy-chain picker implements the same `next_job()` interface.
### Decision rationale
### Decision Rationale
Approach B chosen over A because the iterator abstraction is a one-time design cost that pays off immediately (parjob combinatorial allocation needs it) and compounds (every future allocator reuses it). The four-level picker architecture (project → queue → job + preemption) extends Approach B with design elements from Approach C (policy composition, formalized level separation) that are needed NOW (per-queue pickers, preemption), while deferring the remaining Approach C layers (policy chains with scoring, resreq registry, formal state machine) until real use cases emerge. The iterator interfaces and picker slots are designed to compose upward when needed.
Approach B chosen over A because the iterator abstraction pays off immediately (parjob combinatorial allocation) and compounds (every future allocator reuses it). The picker plugin interface with `next_job()` keeps the core loop simple (5 lines) and makes pickers truly pluggable. Core/driver separation enables simulation mode — a capability that would be prohibitively expensive to retrofit later.
**Updated decision (2026-07-10):** The original Approach B treated the job picker as a single global plugin (`job_pick_plugin` on `xce_scheduler_t`). Design discussion identified that different queues/projects need different pickers, and that preemption is an essential missing mechanism. The architecture now specifies four composable levels (project, queue, job, preemption) with per-queue configuration, LSF-style cross-queue preemption, and a unified loop that works identically for v1 (flat projects) and v2 (hierarchical projects). The project picker level is deferred to a future spec but the architecture slot and interface contract are defined now.
**Design evolution (2026-07-10 → 2026-07-27):** The original design specified a four-level architecture with three separate builtin plugins (`builtin_flat`, `builtin_strict_priority`, `builtin_fcfs`) and a three-level `project→queue→job` loop hardcoded in the core. Analysis of the existing FCFS plugin (`fcfs.c`) showed it already encapsulates all picking logic internally. The architecture was simplified to a single `next_job()` plugin interface with one builtin picker (`builtin_fcfs`) — the three-level decomposition is now an internal implementation detail of the plugin, not the core loop. Core/driver separation was added (Req 10) to enable simulation mode for policy debugging and tuning.
## Approach
**Iterator-Driven Allocation Architecture with Four-Level Picker Composition** (extended from original Approach B):
**Iterator-Driven Allocation with Pluggable Picker + Core/Driver Separation**:
### Core abstractions
```
┌──────────────────────────────────────────────────────────┐
│ Level 0: Project Picker [sched->project_pick_plugin] │
│ │
│ v1 (builtin_flat): yields one "default" project │
│ v2 (future): quota-aware project selection │
└──────────────────────┬───────────────────────────────────┘
│ project scope
▼
┌──────────────────────────────────────────────────────────┐
│ Level 1: Inter-Queue Picker [sched->queue_pick_plugin] │
│ │
│ Iterates queues scoped to the selected project │
│ Default: strict_priority (descending queue->priority) │
└──────────────────────┬───────────────────────────────────┘
│ queue
▼
┌──────────────────────────────────────────────────────────┐
│ Level 2: Intra-Queue Picker [queue→project→sched] │
│ │
│ Picks one job from the selected queue │
│ Default: builtin_fcfs (priority desc, queue_time asc) │
└──────────────────────┬───────────────────────────────────┘
│ job
▼
┌──────────────────────────────────────────────────────────┐
│ Allocation │
│ │
│ xce_alloc_plan_iter_t xce_host_iter_t │
│ ┌─────────────────────┐ ┌──────────────────────┐ │
│ │ init(resreq, sched) │ │ init(plan, workers) │ │
│ │ next() → plan │───────▶│ next() → worker │ │
│ │ fini() │ │ fini() │ │
│ └─────────────────────┘ └──────────────────────┘ │
│ │
│ success → dispatch │
│ fail → Level 3 (preemption) │
└──────────────────────┬──────────────────────────────────┘
│ fail
▼
┌──────────────────────────────────────────────────────────┐
│ Level 3: Preemption │
│ │
│ if queue->preemptible_queues: │
│ victims = preempt_policy.select_victims(job) │
│ if victims: commit XCE_DECISION_PREEMPT │
│ → controller → worker → SIGSTP victims │
│ → victims → JOB_SUSPENDED, release resources │
│ → pend job for next round │
│ else: pend(job, "Resources") │
│ else: pend(job, "Resources") │
└──────────────────────────────────────────────────────────┘
```
### Picker plugin interface
Each picker level follows the same contract:
```c
typedef struct {
void* (*init)(xce_scheduler_t* sched, void* parent_scope);
void* (*next)(void* iter); // returns scope or NULL
void (*fini)(void* iter);
} picker_iface_t;
```
### Unified scheduling loop
### Core scheduling loop
```c
void* sched_allocator(void* arg) {
while (1) {
// Level 0: project scope
scope = project_picker.next(sched);
if (!scope) { sleep(1); continue; }
picker->begin_session(picker);
// Level 1: queue (scoped to project)
queue = queue_picker.next(sched, scope);
if (!queue) { project_picker.advance(); continue; }
// Level 2: job (within queue)
// Precedence: queue->job_pick_plugin → project->job_pick_plugin → sched->job_pick_plugin
picker = resolve_job_picker(sched, queue);
job = picker->elect_one(queue);
if (!job) { queue_picker.advance(); continue; }
// Allocation + preemption
if (try_allocate(sched, job)) {
dispatch(sched, job);
} else if (can_preempt(sched, job)) {
preempt_and_pend(sched, job);
} else {
pend(sched, job, "Resources");
xce_sched_job_t* job;
while ((job = picker->next_job(picker)) != NULL) {
if (try_allocate(job) > 0) {
picker->on_dispatch(picker, job->jobid);
emit_decision(DISPATCH, job);
} else if (can_preempt(job)) {
emit_decision(PREEMPT, job, victims);
picker->on_pend(picker, job->jobid);
} else {
emit_decision(PEND, job);
picker->on_pend(picker, job->jobid);
}
}
picker->end_session(picker);
sleep(1);
}
}
```
This loop is identical for v1 and v2. v1 uses `builtin_flat` for Level 0. v2 replaces it with a quota-aware project picker.
The core loop has zero knowledge of project/queue/job ordering — all selection logic lives behind `next_job()`.
### Picker plugin interface
```c
typedef struct xce_job_picker {
// Lifecycle
int (*init)(void* picker, xce_sched_core_t* core);
void (*fini)(void* picker);
// State-change hooks (called by core when events arrive)
int (*on_queue_update)(void* picker, xce_sched_queue_t* queue);
int (*on_job_push)(void* picker, xce_sched_job_t* job);
int (*on_job_state_change)(void* picker, xce_sched_job_t* job, uint32_t state);
int (*on_job_update)(void* picker, xce_sched_job_t* job);
// Session lifecycle
int (*begin_session)(void* picker);
int (*end_session)(void* picker);
// Job selection
xce_sched_job_t* (*next_job)(void* picker);
// Post-allocation notification
int (*on_dispatch)(void* picker, uint64_t jobid);
int (*on_pend)(void* picker, uint64_t jobid);
// Optional hooks (NULL = not implemented)
int (*on_config)(void* picker, xce_conf4sched_t* config);
int (*on_job_rusage)(void* picker, xce_sched_job_t* job, xce_job_rusages_t* rusages);
} xce_job_picker_iface_t;
```
### builtin_fcfs internal design
The default picker internally implements the equivalent of today's selection:
```
builtin_fcfs.next_job():
Iterate queues by priority (descending)
Skip queues with no ready jobs
For each queue:
If queue has per-queue picker override:
Delegate to that picker
Else:
Iterate jobs by priority desc, queue_time asc (FCFS)
Skip jobs not ready
Return first ready job
Return NULL if all queues exhausted
```
This is an implementation detail of the plugin, not visible to the core loop.
### Preemption flow
```
scheduler controller worker
─────────── ────────── ──────
preempt_policy.select_victims(J)
alloc fails for high-prio job J
preempt_policy.select_victims(J):
collect running jobs from
Q_aggressor.preemptible_queues
filter: victim.prio < J.prio
filter: victim.queue.preemptible
rank: lowest priority first
select minimum set satisfying J.resreq
→ [victim1, victim2]
XCE_DECISION_PREEMPT ────────────▶ handle_job_preempt() ──────▶ SIGSTP victim
.victim_jobids[] deliver to each job → JOB_SUSPENDED
.signal = SIGSTP victim's worker release resources
XCE_DECISION_PREEMPT ────────────▶ handle_job_preempt() ──────▶ SIGSTP victim1
.victim_jobids = [v1, v2] deliver to each job → JOB_SUSPENDED
.signal = SIGSTP victim's worker release resources
.preempting_jobid = J
J pended → next round → retry alloc
```
V1 uses SIGSTP (terminal stop — process groups paused, job stays in queue). Future escalation to SIGKILL kill-and-requeue is deferred.
### Core/Driver Architecture
```
┌──────────────────────────────────────────────────────────────┐
│ DRIVER LAYER │
│ │
│ Normal Mode Simulation Mode │
│ controller capnp ──┐ replay.jsonl ──┐ │
│ handler → events │ virtual clock │ │
│ → publish decisions│ → record/log │ │
│ │ ▲ │ │ ▲ │ │
└───────┼───────┼─────┴──────────────┼───────┼───┴──────────────┘
│ │ decisions │ │ decisions
│ │ (callback) │ │ (callback)
▼ │ ▼ │
┌──────────────────────────────────────────────────────────────┐
│ SCHEDULER CORE │
│ │
│ core_push_event() → picker hooks → picker->next_job() │
│ → try_allocate() → DISPATCH / PREEMPT / PEND │
│ │
│ ZERO dependencies on: controller, capnp, network, wall-clock │
└──────────────────────────────────────────────────────────────┘
```
### What stays unchanged
- Existing plugin hooks (config, queue, job, worker, state_change, commit, election, prepare_allocation, rusage) — all preserved
- Existing plugin hooks (config, queue, job, worker, state_change, commit, election, prepare_allocation, rusage) — preserved, but the picker no longer uses the dedicated `job_elect_fn` thread
- `seqjob_allocator` — wrapped with iterator interface, internally still 1host×1slot
- Select expression system — no changes
- COMPOUND and ALTER resreq types — unchanged (PRIMARY focus)
- Controller communication (handler.c opcodes, decision cbuf) — extended, not replaced
- Controller communication (handler.c opcodes, decision cbuf in driver) — extended, not replaced
- `HOOK_DETAIL_JOB_STOP` — reused for preemption stop notifications
### What's new
- `XCE_DECISION_PREEMPT` decision type
- `xce_preempt_decision_t` payload
- Three builtin plugins: `builtin_flat`, `builtin_strict_priority`, `builtin_fcfs`
- `xce_job_picker_iface_t` — pluggable picker interface with full hook specification
- `xce_alloc_plan_iter_t` + `xce_host_iter_t` — lazy iterator abstractions
- `XCE_DECISION_PREEMPT` decision type + `xce_preempt_decision_t` payload
- `builtin_fcfs` — single builtin picker (replaces three separate builtins from original design)
- `xce_sched_core_t` / `xce_sched_driver_t` / `xce_sched_sim_driver_t` — core/driver struct split
- `xce_core_event_t` — typed event interface between driver and core
- `xce_core_decision_cb_t` — decision callback (core → driver)
- JSONL replay file format + snapshot/restore
- Discrete event-driven virtual clock
- `project_name` on queue structs
- `job_pick_plugin` on queue + project structs
- `job_pick_plugin` on scheduler + queue structs (per-queue override)
- `preemptible_queues`, `preemptible`, `preempt_policy` on queue struct
- `project_pick_plugin`, `queue_pick_plugin`, `job_pick_plugin` on scheduler struct
## Scope
### In
- Unified picker loop: `project → queue → job` with plugin slots at each level
- Three builtin plugins: `builtin_flat` (Level 0), `builtin_strict_priority` (Level 1), `builtin_fcfs` (Level 2)
- Picker plugin interface: `init/next/fini` — cancel-safe, session-aware
- Picker precedence chain: `queue → project → global`
- `xce_alloc_plan_iter_t` interface (header + implementation)
- `xce_host_iter_t` interface (header + implementation)
- Pluggable job picker interface (`xce_job_picker_iface_t` with `next_job()`) hiding all selection logic
- Single builtin picker (`builtin_fcfs`) replicating today's behavior
- Configurable picker plugin with per-queue override (`queue->job_pick_plugin`)
- Picker hook specification: lifecycle, state-change, session, post-allocation, optional hooks
- `xce_alloc_plan_iter_t` + `xce_host_iter_t` interfaces (lazy, cancel-safe, composable)
- `parjob_allocator` combinatorial plan generation (1host×N, 2hosts×⌈N/2⌉, …, Nhhosts×1)
- Preemption: `XCE_DECISION_PREEMPT` decision type, `xce_preempt_decision_t` payload, LSF-style cross-queue victim selection, SIGSTP mechanism via controller→worker pipeline
- Preemption: `XCE_DECISION_PREEMPT` decision type, LSF-style cross-queue victim selection, SIGSTP mechanism
- Per-queue preemption config: `preemptible_queues`, `preemptible`, `preempt_policy`
- Session-level unsatisfiable resreq fingerprint cache
- Data structure changes to `xce_scheduler_t`, `xce_sched_queue_t`, `xce_sched_project_t`, `decision.h`
- Plugin interface contract documentation (cancel-safe, session-aware)
- Unit tests for plan generation, host iteration, cache hit/miss, picker resolution, preemption victim selection
- Core/driver separation: passive event-driven core, normal-mode driver, simulation-mode driver
- Discrete event-driven virtual clock (monotonic, jumps to next event timestamp)
- Runtime recording control via xceadmin commands (`scheduler record start/stop`)
- JSONL replay file format (HEADER + SNAPSHOT + events + DECISIONS)
- State snapshot/restore for replay efficiency
- Deterministic replay guarantee for debugging/tuning
- What-if branching (load snapshot, replay alternative delta events)
- Data structure changes: `xce_scheduler_t`, `xce_sched_queue_t`, `xce_sched_project_t`, `decision.h`, `xce_sched_core_t`, `xce_sched_driver_t`, `xce_sched_sim_driver_t`, `xce_core_event_t`, `xce_job_picker_iface_t`
- Picker plugin interface contract documentation
- Unit tests: plan generation, host iteration, cache hit/miss, picker hook behavior, preemption victim selection, event recording/replay, snapshot/restore, deterministic replay
- Integration test: multi-slot parallel job allocation and preemption flow end-to-end
### Out
- New job selection policy implementations beyond the three builtins (priority, fair-share, deadline, preemption, backfill, etc.) — the configurable slots enable them, but none ship in this spec
- Hierarchical project resource quotas (Level 0 full) — deferred to `project-resource-ownership` spec
- Resreq template registry (named/shared resreq objects) — future enhancement
- New job selection policies beyond the builtin FCFS picker — the pluggable interface enables them, but none ship here
- Hierarchical project resource quotas — deferred to `project-resource-ownership` spec
- Resreq template registry — future enhancement
- Select expression language changes
- Controller-side scheduling state replication (separate concern: commit barrier wiring, see roadmap hardening item)
- Controller-side scheduling state replication (commit barrier wiring)
- Compound/ALTER resreq allocation changes
- GPU/affinity-aware allocation (pluggable later via allocator plugins)
- Kill-and-requeue preemption escalation (v1 is SIGSTP only, suspend-and-retry)
- Deadline field on `xce_sched_job_t` (needed for deadline-based pickers — deferred)
- Kill-and-requeue preemption escalation (v1 is SIGSTP only)
- Deadline field on `xce_sched_job_t`
- Event payload JSON schema (open design question — deferred to design phase)
- Distributed/cluster-mode simulation (v1 is single-scheduler replay only)
## Future: Project Resource Ownership
Deferred to a separate `project-resource-ownership` spec. When implemented:
- Projects form a tree with resource quota at each node
- Level 0 project picker selects which project gets resources (fair-share, priority, proportional)
- Level 1 queue picker is scoped to the selected project's queues
- Level 2 job picker sees only jobs from the selected project within each queue
- Project quota enforcement: projects at or over quota are skipped by Level 0
- The unified picker loop (above) requires zero code changes — only a new project picker plugin replaces `builtin_flat`
- A project-aware picker plugin selects which project gets resources, then iterates queues scoped to that project, then jobs within each queue
- Project quota enforcement: projects over quota are skipped by the picker
- The core scheduling loop requires zero code changes — only a new picker plugin replaces `builtin_fcfs`
- `queue->project_name` (added here) provides the queue→project mapping the v2 picker consumes
- `xce_sched_project_t` scaffolding (added here) provides the struct the v2 picker extends
The architecture is designed so that v1 (flat project space) and v2 (hierarchical projects) share the identical scheduling loop.
The architecture is designed so that v1 (flat, `builtin_fcfs` ignores projects) and v2 (hierarchical, project-aware picker) share the identical core scheduling loop.
## Boundary Candidates
The work naturally splits into these implementation phases (single spec, sequential):
1. **Unified picker loop + builtin plugins** — implement the `project → queue → job` loop with `builtin_flat`, `builtin_strict_priority`, `builtin_fcfs`; retire `sched_job_picker()`; add plugin slots and precedence chain to structs
2. **Iterator interfaces** — define `xce_alloc_plan_iter_t` and `xce_host_iter_t`, implement for seqjob path first (trivial wrapper), validate the abstraction
3. **Parallel job allocator** — implement combinatorial plan generation in `parjob_allocator`, wire through host iterator
4. **Preemption** — implement `XCE_DECISION_PREEMPT` decision type, cross-queue victim selection policy, SIGSTP pipeline (scheduler→controller→worker), queue preemption config fields
5. **Unsatisfiable resreq cache** — session-level fingerprint cache, wire into scheduling loop (skip before allocation + preemption attempt)
6. **Integration + testing** — end-to-end multi-slot parallel job allocation, preemption flow, picker resolution, cache behavior, HA soak regression
1. **Core/driver separation** — split `xce_scheduler_t` into `xce_sched_core_t` + `xce_sched_driver_t`; define `xce_core_event_t` and `xce_core_decision_cb_t`; implement passive event-driven core interface; wire normal-mode driver to existing handler.c
2. **Picker plugin interface + builtin_fcfs** — define `xce_job_picker_iface_t`; implement `builtin_fcfs` with all MUST/SHOULD hooks; retire dedicated picker thread + `jbuf`; make core loop call `next_job()` synchronously; add `job_pick_plugin` config with per-queue override
3. **Iterator interfaces** — define `xce_alloc_plan_iter_t` and `xce_host_iter_t`, implement for seqjob path first (trivial wrapper), validate the abstraction
4. **Parallel job allocator** — implement combinatorial plan generation in `parjob_allocator`, wire through host iterator
5. **Preemption** — implement `XCE_DECISION_PREEMPT` decision type, cross-queue victim selection policy, SIGSTP pipeline, queue preemption config fields
6. **Unsatisfiable resreq cache** — session-level fingerprint cache, wire into scheduling loop
7. **Simulation driver** — implement simulation-mode driver with JSONL replay, virtual clock, snapshot/restore, deterministic verification
8. **Recording + xceadmin commands** — implement runtime recording control, periodic snapshots during recording
9. **Integration + testing** — end-to-end multi-slot parallel job allocation, preemption flow, picker resolution, cache behavior, simulation replay, HA soak regression
## Out of Boundary
- New job selection policy implementations (priority, fair-share, etc.) — these are new plugins that USE the configurable picker, not part of this spec
- New job selection policy implementations (priority, fair-share, etc.) — these are new plugins that implement `xce_job_picker_iface_t`
- Resreq template sharing across jobs (future: `resreq_registry` spec)
- Commit barrier wiring for scheduler decisions (separate hardening item in roadmap)
- Controller-side changes (the scheduler runs independently, receives updates via existing opcodes)
@ -312,10 +356,11 @@ The work naturally splits into these implementation phases (single spec, sequent
- Existing plugin framework (`plugin.h`, `plugin.c`) — NO changes needed
- Existing select expression evaluator (`resreq.h` eval/Gc) — NO changes needed
- Existing shared resource tracking (`sharedInst`/`sharedInUse`) — NO changes needed
- Existing scheduler data structures (`xce_scheduler_t`, `xce_sched_ctx_t`) — minimal additions
- Existing scheduler data structures (`xce_scheduler_t`, `xce_sched_ctx_t`) — split, not replaced
### Downstream (future consumers)
- **New job selection policies** — priority, fair-share, preemption plugins register via the configurable picker
- **New job selection policies** — priority, fair-share, deadline, backfill plugins implement `xce_job_picker_iface_t`
- **Project-resource-ownership** — project-aware picker plugin consumes `queue->project_name` and `xce_sched_project_t`
- **Affinity/GPU allocators** — register as allocator plugins, implement plan iterator for topology-aware placement
- **Commit barrier wiring** — scheduling decisions flow through majority commit (separate hardening item)
- **Resreq template registry** — named resreqs shared across jobs, reference-counted
@ -323,7 +368,7 @@ The work naturally splits into these implementation phases (single spec, sequent
## Existing Spec Touchpoints
### Extends
- **scheduler-controller-msg-gap** — adjacent (message handling). The framework enhancement operates on the same `xce_scheduler_t` state. No conflicts; the msg-gap spec fills handler gaps this spec reads from.
- **scheduler-controller-msg-gap** — adjacent (message handling). The framework enhancement operates on the same scheduling state. No conflicts; the msg-gap spec fills handler gaps this spec reads from.
### Adjacent
- **ha-consistency-invariants** — commit barrier that scheduling decisions will eventually flow through. This spec does NOT wire the barrier; it only makes allocation decisions that the barrier WILL consume.
@ -332,7 +377,8 @@ The work naturally splits into these implementation phases (single spec, sequent
## Constraints
- **C (gnu17)** — no C++, no external libraries beyond existing (capnp, zlib, pthreads)
- **Non-blocking in plugin hooks** — allocation happens on allocator thread, not iomgr. No new blocking concerns.
- **Cancel-safe** — job picker thread is `pthread_cancel`-able. Iterator `next()` calls must have cancellation points.
- **Session isolation** — iterator state and resreq cache are per-session, cleared on `begin_session`.
- **Cancel-safe** — `next_job()` must have `pthread_cancel` cancellation points
- **Session isolation** — iterator state and resreq cache are per-session, cleared on `begin_session`
- **Backward compatible** — existing FCFS + seqjob behavior unchanged. New functionality is additive.
- **Deterministic replay** — same initial state + same event sequence → same decisions. No wall-clock time, no unseeded randomness, stable iteration order.
- **Memory** — lazy generation avoids materializing all combinations. Worst-case for a job needing N slots on M hosts: M×N candidate evaluations (acceptably bounded).

783
.kiro/specs/scheduler-framework/requirements.md
View file

@ -4,18 +4,13 @@
The XCE scheduler has a plugin architecture (`plugin.h`/`plugin.c`, `xce_sched_plugin_t`) but three gaps keep it from being a real framework. First, job selection policy is hardcoded: `sched_job_picker()` (`scheduler.c:39`) sets `job_pick_plugin = "xce_sched_fcfs"` as a literal, so swapping policies requires recompilation. Second, parallel job allocation is a stub: `parjob_allocator.c:73`'s `my_alloc()` takes `(plugin, ctx)` and immediately `return 0` — any job with `maxTasks > 1` (routed there by `sched_make_primary_alloc_()` at `scheduler.c:93-103`) produces no allocation at all. Third, allocation is eager and one-shot: the sibling `seqjob_allocator.c:107` `my_alloc()` (used when `maxTasks == 1`) calls `sched_collect_workers()` then `xlist_find()` for the first host that satisfies the request and stops — there is no mechanism to generate alternative host/slot combinations and retry when the first plan fails.
This feature closes all three gaps with an iterator-driven allocation architecture: a lazy `xce_alloc_plan_iter_t` (candidate `(nhosts, slots_per_host)` plans, most-preferred first) composed with a lazy `xce_host_iter_t` (candidate hosts for a given plan, filtered by the existing select-expression evaluator), a `parjob_allocator` implementation that walks the plan iterator to do real combinatorial multi-slot allocation, and a session-scoped unsatisfiable-resreq fingerprint cache so a job whose resreq no plan can satisfy doesn't re-pay full allocation cost for every later job with the same fingerprint in the same scheduling session.
This feature closes all three gaps and adds two architectural foundations:
Beyond the three gaps, this feature introduces a **four-level scheduling architecture** that separates concerns cleanly and composes upward:
**Allocation**: A lazy `xce_alloc_plan_iter_t` (candidate `(nhosts, slots_per_host)` plans, most-preferred first) composed with a lazy `xce_host_iter_t` (candidate hosts for a given plan, filtered by the existing select-expression evaluator), a `parjob_allocator` implementation that walks the plan iterator to do real combinatorial multi-slot allocation, and a session-scoped unsatisfiable-resreq fingerprint cache so a job whose resreq no plan can satisfy doesn't re-pay full allocation cost for every later job with the same fingerprint in the same scheduling session.
| Level | Picker | Question it answers | Plugin slot | Default (v1) |
|-------|--------|---------------------|-------------|---------------|
| 0 | Project picker | WHO gets resources this round? | `sched->project_pick_plugin` | `"builtin_flat"` — single "default" project |
| 1 | Inter-queue picker | WHICH queue within the project? | `sched->queue_pick_plugin` | `"builtin_strict_priority"` |
| 2 | Intra-queue picker | WHICH job from this queue? | `queue→project→sched` precedence chain | `"builtin_fcfs"` |
| 3 | Preemption policy | WHAT to preempt when allocation fails? | `queue->preempt_policy` | `"lowest_priority_first"` |
**Job picking**: A pluggable `xce_job_picker_iface_t` — the core scheduling loop calls `picker->next_job()` to get the next schedulable job, with zero knowledge of how jobs are selected (FCFS, priority, fair-share, deadline, etc.). The default `builtin_fcfs` picker internally implements queue-priority ordering and FCFS job ordering, replicating today's behavior exactly. Per-queue picker overrides are supported. Preemption fires at Level 3 when allocation fails for a preemptible job.
The scheduling loop is always `project → queue → job`, with Level 0 collapsing to a single implicit "default" project in v1 and expanding to hierarchical resource ownership in a future spec (`project-resource-ownership`). Level 3 (preemption) fires only when allocation fails for a preemptible job.
**Core/driver separation**: The scheduler core is a passive, event-driven engine with zero controller I/O dependencies. A normal-mode driver connects it to a live controller; a simulation-mode driver replays recorded cluster events through a discrete event-driven virtual clock, enabling policy debugging, tuning, regression testing, and what-if analysis without a live cluster.
> Full discovery context (problem, current state, alternatives considered, approach, boundary, upstream/downstream) is in `.kiro/specs/scheduler-framework/brief.md`.
@ -32,30 +27,223 @@ These are fundamentally different concerns:
| **Cardinality to job** | 1 job → 1 queue | 1 job → 1 project |
| **Cardinality to each other** | Many-to-many | Many-to-many |
- **Queue** = submission channel with scheduling policy. Owns resource thresholds (RUNLIMIT, MAX_RUNNING), time windows, inter-queue priority, and the intra-queue job picker.
- **Project** = resource ownership boundary. Owns quota, consumption tracking, hierarchical nesting, and accounting. One project submits to many queues; one queue receives from many projects.
- **Queue** = submission channel with scheduling policy. Owns resource thresholds (RUNLIMIT, MAX_RUNNING), time windows, priority (for inter-queue ordering within the picker), per-queue picker override, and preemption config.
- **Project** = resource ownership boundary. Owns quota, consumption tracking, hierarchical nesting, and accounting. One project submits to many queues; one queue receives from many projects. The picker plugin may use `queue->project_name` internally for project-scoped iteration (v2).
## Boundary Context
- **In scope**: Unified picker loop (`project → queue → job`) with plugin slots at each level; `xce_alloc_plan_iter_t` and `xce_host_iter_t` interfaces (lazy, cancel-safe, composable); `seqjob_allocator` rewrapped onto the iterator interface as a trivial 1-plan/1-host-loop case (behavior unchanged, `maxTasks == 1` only); `parjob_allocator`'s `my_alloc()` implementing real combinatorial plan generation (1host×N, 2hosts×⌈N/2⌉, …, Nhosts×1) for `maxTasks > 1`; three builtin plugins (`builtin_flat`, `builtin_strict_priority`, `builtin_fcfs`) replicating today's behavior through the new architecture; configurable picker slots with precedence chain (`queue → project → global`); preemption decision type (`XCE_DECISION_PREEMPT`) flowing scheduler→controller→worker with SIGSTP mechanism; cross-queue victim selection (LSF-style per-queue `preemptible_queues` list); session-level unsatisfiable-resreq fingerprint cache keyed on `{select, rusage, user, queue, project}`; documentation of plugin interface contracts (cancel-safe, session-aware); unit tests for plan generation, host iteration, cache hit/miss, picker resolution, preemption victim selection; integration test for end-to-end multi-slot parallel job allocation and preemption flow.
- **In scope**: Pluggable job picker interface (`xce_job_picker_iface_t` with `next_job()`) hiding all selection logic behind a single plugin; `xce_alloc_plan_iter_t` and `xce_host_iter_t` interfaces (lazy, cancel-safe, composable); `seqjob_allocator` rewrapped onto the iterator interface as a trivial 1-plan/1-host-loop case (behavior unchanged, `maxTasks == 1` only); `parjob_allocator`'s `my_alloc()` implementing real combinatorial plan generation (1host×N, 2hosts×⌈N/2⌉, …, Nhosts×1) for `maxTasks > 1`; single builtin picker (`builtin_fcfs`) replicating today's behavior through the new interface; configurable picker plugin with per-queue override (`queue->job_pick_plugin`); preemption decision type (`XCE_DECISION_PREEMPT`) flowing scheduler→controller→worker with SIGSTP mechanism; cross-queue victim selection (LSF-style per-queue `preemptible_queues` list); session-level unsatisfiable-resreq fingerprint cache keyed on `{select, rusage, user, queue, project}`; **core/driver separation** with passive event-driven core interface, normal-mode driver (controller-connected), simulation-mode driver (replay recorded events with discrete event-driven virtual clock), runtime recording control via xceadmin commands, JSONL replay file format, state snapshot/restore for replay efficiency, and deterministic replay guarantee for debugging/tuning; documentation of picker plugin interface contract (hooks, cancel-safe, session-aware); unit tests for plan generation, host iteration, cache hit/miss, picker hook behavior, preemption victim selection, **event recording/replay, snapshot/restore, and deterministic replay**; integration test for end-to-end multi-slot parallel job allocation and preemption flow.
- **Out of scope**: New job selection policies beyond the three builtins (priority, fair-share, deadline, preemption, backfill) — the configurable slots enable them, but none ship in this spec beyond the builtins; a resreq template registry (named/shared resreq objects); changes to the select-expression language or evaluator; controller-side scheduling-state replication / commit-barrier wiring for scheduling decisions (separate roadmap hardening item, tracked adjacent to `ha-consistency-invariants`); `COMPOUND`/`ALTER` resreq allocation changes beyond what composing over `PRIMARY` already provides; GPU/topology/affinity-aware allocation (left pluggable via future allocator plugins); hierarchical project resource quotas (Level 0 full — deferred to `project-resource-ownership` spec); kill-and-requeue preemption escalation (deferred — v1 is SIGSTP only); deadline field on `xce_sched_job_t` (deferred — needed for deadline-based pickers).
- **Out of scope**: New job selection policies beyond the builtin FCFS picker (priority, fair-share, deadline, backfill) — the pluggable picker interface enables them, but none ship in this spec beyond `builtin_fcfs`; a resreq template registry (named/shared resreq objects); changes to the select-expression language or evaluator; controller-side scheduling-state replication / commit-barrier wiring for scheduling decisions (separate roadmap hardening item, tracked adjacent to `ha-consistency-invariants`); `COMPOUND`/`ALTER` resreq allocation changes beyond what composing over `PRIMARY` already provides; GPU/topology/affinity-aware allocation (left pluggable via future allocator plugins); hierarchical project resource quotas (deferred to `project-resource-ownership` spec — only `project_name` on queue and `xce_sched_project_t` scaffolding ship here); kill-and-requeue preemption escalation (deferred — v1 is SIGSTP only); deadline field on `xce_sched_job_t` (deferred — needed for deadline-based pickers); **event payload JSON schema** (open design question — deferred to design phase); **distributed/cluster-mode simulation** (v1 is single-scheduler replay only).
- **Adjacent expectations**: depends on the existing plugin framework (`plugin.h`/`plugin.c`), the existing select-expression evaluator (`resreq.h`, memoized via `select_eval_ctx_t`), and existing shared-resource tracking (`xce_scheduler_t.sharedInst`/`sharedInUse`) — none of these change. `scheduler-controller-msg-gap` (implemented) governs controller↔scheduler message handling this feature reads state through but does not modify. `ha-consistency-invariants`' commit barrier is a future consumer of scheduling decisions; this feature does not wire it. Controller hook `HOOK_DETAIL_JOB_STOP` (enum value 65 in `cluster_def.h`) already exists and is reused for preemption stop actions.
## Allocation Architecture (Reqs 2–4)
Requirements 2, 3, and 4 form a three-layer allocation architecture. These layers compose according to the job's resource request type (PRIMARY, COMPOUND, or ALTER):
### Resreq Type Hierarchy
```
ALTER → OR-of-compounds: first compound that fully allocates wins
└─ COMPOUND → AND-of-primaries: ALL primaries must allocate for success
└─ PRIMARY → plan_iter → host_iter → try_alloc (leaf level)
```
The iterator composition (`xce_alloc_plan_iter_t` + `xce_host_iter_t`) operates at the **PRIMARY leaf**. COMPOUND and ALTER are composition rules above the iterators — they call into the same primary allocator, unchanged from today's `sched_make_compound_allocation()` and `sched_make_alter_allocation()` dispatch.
### Iterator Composition (PRIMARY leaf)
```
┌──────────────────────────┐
│ xce_alloc_plan_iter_t │ Req 2
│ │
│ init(primary_resreq) │
│ next() → plan │ generates (nhosts, slots_per_host)
│ fini() │ candidates, most-preferred first
└────────────┬───────────────┘
│ plan
▼
┌──────────────────────────┐
│ xce_host_iter_t │ Req 3
│ │
│ init(plan, workers) │ for a given plan, iterate
│ next() → worker │ candidate hosts matching
│ fini() │ select expression + availability
└────────────┬───────────────┘
│ worker
▼
┌──────────────────────────┐
│ try_alloc(worker, plan) │ Req 4 (parjob) or
│ │ existing seqjob logic
│ check slots, shared res, │
│ commit or advance │
└────────────────────────────┘
```
### Composition Algorithm (All Three Types)
```c
// === PRIMARY leaf: iterator composition ===
// Returns >0 on success, 0 on failure
int allocate_primary(sched, primary_resreq, ctx) {
plan_iter = plan_iter_init(primary_resreq, sched);
while ((plan = plan_iter->next(plan_iter)) != NULL) {
host_iter = host_iter_init(plan, sched->workers);
while ((worker = host_iter->next(host_iter)) != NULL) {
if (try_alloc_on_host(worker, plan, ctx) > 0) {
host_iter->fini(host_iter);
plan_iter->fini(plan_iter);
return ALLOC_SUCCESS;
}
}
host_iter->fini(host_iter);
}
plan_iter->fini(plan_iter);
return ALLOC_FAIL;
}
// === COMPOUND: AND of primaries ===
// ALL primaries must allocate. On any failure, roll back prior allocations
// and return failure. Same logic as today's sched_make_compound_allocation().
int allocate_compound(sched, compound_resreq, ctx) {
for (int i = 0; i < compound_resreq->primaries.count; i++) {
primary = compound_resreq->primaries[i];
if (allocate_primary(sched, primary, ctx) <= 0) {
// Roll back all primaries allocated so far in this compound
rollback_compound_allocations(ctx, i);
return ALLOC_FAIL;
}
}
return ALLOC_SUCCESS;
}
// === ALTER: OR of compounds ===
// First compound that fully allocates wins. Same logic as today's
// sched_make_alter_allocation(). On failure, no rollback needed
// (prior compounds were never committed — they failed their own checks).
int allocate_alter(sched, alter_resreq, ctx) {
for (int i = 0; i < alter_resreq->compounds.count; i++) {
compound = alter_resreq->compounds[i];
if (allocate_compound(sched, compound, ctx) > 0) {
return ALLOC_SUCCESS;
}
// This compound failed — advance to next alternative
}
return ALLOC_FAIL;
}
// === Top-level dispatch ===
// Unchanged from today's sched_make_allocation() dispatch on obj->tag.
int allocate_job(sched, job, ctx) {
switch (job->resreq_type) {
case PRIMARY:
return allocate_primary(sched, job->primary_resreq, ctx);
case COMPOUND:
return allocate_compound(sched, job->compound_resreq, ctx);
case ALTER:
return allocate_alter(sched, job->alter_resreq, ctx);
}
}
```
**COMPOUND rollback note:** If primaries 1 and 2 of a compound allocate but primary 3 fails, primaries 1 and 2 must be rolled back — the compound is atomic. Today this is handled by `sched_make_compound_allocation()` tracking allocations in `ctx` and cleaning up on failure. This behavior is unchanged; the iterator interfaces don't alter the rollback contract.
### Who Uses This Composition
| Allocator | `maxTasks` | Plan iterator | Host iterator | Behavior |
|-----------|------------|---------------|---------------|----------|
| `seqjob_allocator` | `== 1` | Trivial: single plan (1 host × 1 slot) | Full: filters hosts by select expression | Unchanged from today — first matching host wins |
| `parjob_allocator` | `> 1` | Full combinatorial: 1host×N, 2hosts×⌈N/2⌉, …, Nhosts×1 | Full: filters hosts with enough available slots | New — walks plans until one succeeds |
| Future allocators | any | Custom strategy (e.g., topology-aware, bin-packing) | Reuses same `xce_host_iter_t` | Pluggable via `job_alloc_fn` |
### Key Design Properties
- **Lazy**: `plan_iter->next()` generates one plan at a time. `host_iter->next()` returns one host at a time. No full materialization.
- **Cancel-safe**: both `next()` calls have `pthread_cancel` cancellation points.
- **Independent lifecycles**: a `host_iter` is created from a plan, used, and destroyed; the `plan_iter` is advanced to the next plan only after the `host_iter` is done. `fini()` on one does not affect the other.
- **COMPOUND/ALTER unchanged**: the composition rules above the PRIMARY leaf (AND for compound, OR for alter) are unchanged from today. The iterator interfaces only change what happens inside `allocate_primary()`.
- **seqjob rewrap**: `seqjob_allocator` is rewrapped onto the iterator interfaces as a trivial case — its plan iterator always returns the single plan (1 host × 1 slot), and the inner loop is identical to today's first-match logic. This validates the abstraction before applying it to the complex parjob case.
## Requirements
### Requirement 1: Unified picker loop (project → queue → job)
### Requirement 1: Pluggable job picker interface
**Objective:** As a maintainer of the scheduler, I want a single scheduling loop that composes project, queue, and job pickers in a fixed order, so that v1 (flat project space) and v2 (hierarchical projects with resource quotas) share the same code path.
**Objective:** As a maintainer of the scheduler, I want the core scheduling loop to call a single `next_job()` plugin interface with no knowledge of how jobs are selected, so that picking strategies (FCFS, priority, fair-share, deadline, etc.) are truly pluggable and the core loop never changes regardless of the picking algorithm.
#### Acceptance Criteria
1. The Scheduler shall implement a scheduling loop that always follows the order: Level 0 (project picker) → Level 1 (inter-queue picker) → Level 2 (intra-queue picker) → allocation.
2. Each picker level shall conform to a common interface contract: `init(sched, parent_scope)`, `next(iter) → scope_or_NULL`, `fini(iter)`.
3. When a picker at any level returns NULL (exhausted), the loop shall advance the parent picker to its next scope and restart the child picker from that new scope.
4. In v1 (no project hierarchy), the default project picker `builtin_flat` shall yield exactly one scope: a "default" project containing all configured queues, so the loop behavior is identical to today's flat queue iteration.
5. Plugin resolution for Level 2 shall follow the precedence chain: `queue->job_pick_plugin` → `project->job_pick_plugin` → `sched->job_pick_plugin` → hardcoded default `"builtin_fcfs"`.
6. `sched_job_picker()` shall be retired and replaced by the unified loop; the hardcoded `"xce_sched_fcfs"` literal at `scheduler.c:43` shall be removed.
1. The Scheduler core loop shall call `picker->next_job(picker)` to get the next schedulable job (or NULL if none ready), and shall not contain any logic about project iteration, queue iteration, or job ordering — those concerns are entirely encapsulated inside the picker plugin.
2. The job picker plugin interface (`xce_job_picker_iface_t`) shall define these operations, organized by category:
**Lifecycle hooks** (MUST):
| Operation | Signature | Semantics |
|-----------|-----------|-----------|
| `init` | `int (*init)(void* picker, xce_sched_core_t* core)` | One-time setup, receives core reference for state queries |
| `fini` | `void (*fini)(void* picker)` | Teardown and cleanup of all picker-owned resources |
**State-change hooks** (MUST — called by core when events arrive from driver):
| Operation | Signature | Semantics | Triggered by |
|-----------|-----------|-----------|-------------|
| `on_queue_update` | `int (*on_queue_update)(void* picker, xce_sched_queue_t* queue)` | Add/update queue in picker's internal ordering | `QUEUE_UPDATE` event |
| `on_job_push` | `int (*on_job_push)(void* picker, xce_sched_job_t* job)` | Add new pending job to picker's candidate set | `JOBS_PUSH` event |
| `on_job_state_change` | `int (*on_job_state_change)(void* picker, xce_sched_job_t* job, uint32_t new_state)` | Remove job from candidates if no longer pending; re-add if returning to pending | `JOB_STATE_CHANGE` event |
| `on_job_update` | `int (*on_job_update)(void* picker, xce_sched_job_t* job)` | Reorder job in candidates if priority/queue changed | `JOB_UPDATE` event |
**Session hooks** (MUST — called at round boundaries):
| Operation | Signature | Semantics |
|-----------|-----------|-----------|
| `begin_session` | `int (*begin_session)(void* picker)` | Reset iteration cursor; called at start of each scheduling round |
| `next_job` | `xce_sched_job_t* (*next_job)(void* picker)` | Return next schedulable job per picker's ordering, or NULL when exhausted |
| `end_session` | `int (*end_session)(void* picker)` | End-of-round notification; called before core sleeps between rounds |
**Post-allocation hooks** (MUST — called after allocation attempt):
| Operation | Signature | Semantics |
|-----------|-----------|-----------|
| `on_dispatch` | `int (*on_dispatch)(void* picker, uint64_t jobid)` | Job was allocated; remove from candidates permanently |
| `on_pend` | `int (*on_pend)(void* picker, uint64_t jobid)` | Job was pended; keep for next round but may deprioritize |
**Optional hooks** (MAY — NULL if not needed):
| Operation | Signature | Semantics | When needed |
|-----------|-----------|-----------|------------|
| `on_config` | `int (*on_config)(void* picker, xce_conf4sched_t* config)` | Rebuild picker strategy from config | Config-driven pickers (deadline, fair-share weights) |
| `on_job_rusage` | `int (*on_job_rusage)(void* picker, xce_sched_job_t* job, xce_job_rusages_t* rusages)` | Track per-job resource usage | Resource-aware pickers (fair-share, backfill) |
Hooks not defined on the picker interface (worker updates, resource updates, resval updates) are not forwarded to the picker — picking is about job ordering, not resource availability.
3. The core shall call state-change hooks synchronously during `core_push_event()` processing, before the event returns. Session hooks and post-allocation hooks are called synchronously during the scheduling session (between `BEGIN_ROUND` and session exhaustion). The picker runs in the core's scheduling thread — no dedicated picker thread.
4. The core scheduling loop shall:
```c
begin_session();
while ((job = picker->next_job(picker)) != NULL) {
if (try_allocate(job) > 0) {
picker->on_dispatch(picker, job->jobid);
emit_decision(DISPATCH, job);
} else if (can_preempt(job)) {
emit_decision(PREEMPT, job, victims);
picker->on_pend(picker, job->jobid); // retry next round
} else {
emit_decision(PEND, job);
picker->on_pend(picker, job->jobid);
}
}
end_session();
```
The core loop shall contain zero knowledge of project/queue/job ordering — all selection logic lives behind `next_job()`.
5. The picker plugin shall be cancel-safe: `next_job()` shall have defined `pthread_cancel` cancellation points. The picker shall be session-aware: `begin_session()` resets iteration state, `end_session()` is called before sleep-between-rounds.
6. The hardcoded `"xce_sched_fcfs"` literal at `scheduler.c:43` (in `sched_job_picker()`) shall be replaced by loading the configured `sched->job_pick_plugin` via the existing `plugin_register`/`key_find` mechanism. If the configured plugin name is not registered, the Scheduler shall fail with a clear configuration error (same pattern as Req 5 AC 5).
7. `sched_job_picker()`'s dedicated thread and `jbuf` cbuf communication shall be retired. The picker runs synchronously within the core's scheduling thread — `next_job()` is called directly, not via a separate thread + cbuf. This eliminates one thread and simplifies the session lifecycle for simulation mode.
### Requirement 2: Lazy allocation plan iterator
@ -90,20 +278,22 @@ These are fundamentally different concerns:
4. When no plan among those generated in Criterion 1 can be satisfied, `my_alloc()` shall return the same not-satisfied signal (`0`) that the current stub returns today, so pend-reason handling in `sched_make_primary_alloc_()` is unaffected.
5. `parjob_allocator`'s `job_alloc_fn` shall no longer unconditionally `return 0` regardless of `ctx` contents — the current stub behavior — for any job with `maxTasks > 1`.
### Requirement 5: Configurable picker plugin slots
### Requirement 5: Configurable picker plugin
**Objective:** As a cluster operator, I want to configure job-picking policies at the scheduler, queue, and project levels without recompiling the scheduler, so that FCFS, priority, or custom pickers can be swapped operationally and composed.
**Objective:** As a cluster operator, I want to configure which job-picking policy the scheduler uses without recompiling, and override it per-queue, so that FCFS, priority, or custom pickers can be swapped operationally.
#### Acceptance Criteria
1. The Scheduler shall add a `project_pick_plugin` field to `xce_scheduler_t`, defaulting to `"builtin_flat"` when unset.
2. The Scheduler shall add a `queue_pick_plugin` field to `xce_scheduler_t`, defaulting to `"builtin_strict_priority"` when unset.
3. The Scheduler shall add a `job_pick_plugin` field to `xce_scheduler_t`, defaulting to `"builtin_fcfs"` when unset — serving as the global fallback.
4. The Scheduler shall add a `job_pick_plugin` field to `xce_sched_queue_t`, defaulting to NULL (inherit from project or global).
5. The Scheduler shall add a `job_pick_plugin` field to `xce_sched_project_t`, defaulting to NULL (inherit from global).
6. The Scheduler shall add a `project_name` field to `xce_sched_queue_t`, set from queue configuration, establishing the queue→project relationship for Level 1 scoping.
7. The Scheduler shall accept all picker plugin names from scheduler configuration (or equivalent operator-facing settings), applied at scheduler startup without requiring a rebuild.
8. When a plugin slot names a plugin not registered via the existing `plugin_register`/`key_find` mechanism, the Scheduler shall fail with a clear configuration error rather than silently falling back to the builtin default.
9. The Scheduler shall document the picker plugin interface contract: each picker must be cancel-safe (responds to `pthread_cancel` at defined points) and session-aware (resets its state on `end_session`).
1. The Scheduler shall add a `job_pick_plugin` field to `xce_scheduler_t`, defaulting to `"builtin_fcfs"` when unset — this is the global picker plugin name.
2. The Scheduler shall add a `job_pick_plugin` field to `xce_sched_queue_t`, defaulting to NULL (inherit from global). When non-NULL, the configured global picker plugin shall use this per-queue override for jobs within that queue. How the picker plugin uses per-queue overrides is an implementation detail of the plugin, not the core loop.
3. The Scheduler shall add a `project_name` field to `xce_sched_queue_t`, set from queue configuration, establishing the queue→project relationship. The picker plugin may use this field internally for project-scoped iteration.
4. The Scheduler shall accept the picker plugin name from scheduler configuration (or equivalent operator-facing settings), applied at scheduler startup without requiring a rebuild.
5. When the configured plugin name is not registered via the existing `plugin_register`/`key_find` mechanism, the Scheduler shall fail with a clear configuration error rather than silently falling back to the builtin default.
6. The picker plugin interface contract (`xce_job_picker_iface_t`) shall be documented: each picker must be cancel-safe (responds to `pthread_cancel` at defined points in `next_job()`) and session-aware (resets its iteration state on `begin_session()`).
### Requirement 6: Preemption policy and execution
@ -131,15 +321,58 @@ These are fundamentally different concerns:
4. Before starting full allocation for a job, the Scheduler shall look up the job's resreq fingerprint in the cache; on a hit, it shall pend the job immediately without invoking the plan or host iterators or preemption.
5. A cache hit shall attribute the same pend reason category as the original unsatisfiable determination, so operators are not misled about why a later job was skipped.
### Requirement 8: Builtin default plugins
### Architectural Support for Future Object Sharing (Deferred)
**Objective:** As a maintainer, I want the new architecture to ship with builtin plugins that replicate today's exact scheduling behavior, so that operators who don't configure custom pickers see no behavioral change.
Full object sharing (resreq template registry, pend reason dedup pool) is deferred to a follow-up spec. However, the architecture designed in this spec must not block sharing from being added later. The following design invariants apply to all resreq, pend-reason, and related objects touched by this spec:
1. **Resreq immutability**: `xce_primary_resreq_t`, `xce_compound_resreq_t`, and `xce_alter_resreq_t` objects shall be treated as immutable once created and validated. No code path shall mutate a resreq in place. Any modification (e.g., expanding a job-array template into per-element resreqs) shall create a new copy. This ensures that sharing via `const` pointer is safe to introduce later without auditing every consumer for mutation.
2. **Pend reason factory**: All pend reason allocation shall go through `make_pendreason()` (already the single factory in `lib/preason.c`). Callers never `calloc(sizeof(xce_pendreason_t))` directly. This ensures a session-level dedup pool can be added inside the factory later without changing any caller.
3. **Pointer-identity fast path**: Code that compares two resreqs or two pend reasons shall use pointer equality (`a == b`) as a fast path before falling back to deep comparison. When a resreq registry is introduced, identical resreqs will have the same pointer — the fast path avoids repeated deep comparison for no runtime cost today.
4. **Select expression memoization**: The existing `select_eval_ctx_t` per-session memoization of parsed select-expression ASTs shall be preserved and extended to the core's internal resreq objects. The parsed/evaluated form of a select expression shall be attached to the resreq on first evaluation and reused for subsequent evaluations (same session, same resreq pointer).
5. **Snapshot forward-compatibility**: The snapshot format shall not preclude object sharing. Shared objects in the snapshot shall be serializable by identity (an object table with IDs) rather than requiring inline embedding at every reference site. This is a design-phase concern but constrains the JSON schema choice.
These invariants impose zero overhead in the current implementation — immutability is already the pattern, pointer-identity fast paths are already valid C, and the factory already exists. They simply rule out design choices that would make sharing expensive or impossible to retrofit.
### Requirement 8: Builtin default picker
**Objective:** As a maintainer, I want the new architecture to ship with a builtin picker plugin that replicates today's exact scheduling behavior, so that operators who don't configure a custom picker see no behavioral change.
#### Acceptance Criteria
1. **`builtin_flat`** (Level 0, project picker): shall yield exactly one "default" project scope per scheduling round. All queues not explicitly assigned to a project belong to this default project. Always eligible; never exhausted during a session.
2. **`builtin_strict_priority`** (Level 1, inter-queue picker): shall iterate queues in descending priority order (`queue->priority`). Shall skip queues with no pending jobs (`sched_queue_is_ready` returns false). When scoped to a project, shall only iterate queues belonging to that project. Shall return NULL when all eligible queues are exhausted.
3. **`builtin_fcfs`** (Level 2, intra-queue picker): shall replicate today's FCFS behavior — iterate pending jobs within the queue by `priority desc, queue_time asc`. Shall skip jobs where `sched_job_is_ready` returns false. Shall communicate the picked jobid via the existing `jbuf` cbuf mechanism. Shall be cancel-safe and session-aware.
4. All three builtin plugins shall be registered automatically at scheduler startup without requiring explicit configuration.
1. **Registration**: `builtin_fcfs` shall be registered automatically at scheduler startup as `"builtin_fcfs"` and set as the default `sched->job_pick_plugin`.
2. **Hook implementation** — `builtin_fcfs` shall implement every MUST and SHOULD hook from `xce_job_picker_iface_t` (Req 1 AC 2) as follows:
| Hook | FCFS Implementation |
|------|-------------------|
| `init` | Allocate `fcfs_plugin_data_t`. Initialize `ordq_t queues` (ordered by `queue->priority desc`). Set iteration cursor to NULL. |
| `fini` | Free all per-queue `ordq_t pendJobs`, the `ordq_t queues`, and plugin data. |
| `on_queue_update` | Upsert queue into `ordq_t queues`. If queue exists, update its priority and reorder. If new, allocate `fcfs_queue_t` with empty `ordq_t pendJobs`. |
| `on_job_push` | If `job->state & JOB_STAT_PEND`: find the job's queue in `ordq_t queues`, add `fcfs_job_t{job}` to that queue's `ordq_t pendJobs` (ordered by `priority desc, queue_time asc`). |
| `on_job_state_change` | If `new_state` is not pending (EXIT/FAIL/DONE): remove job from its queue's `pendJobs` by jobid. If `new_state` returns to PEND: re-add to `pendJobs`. |
| `on_job_update` | If job's `priority` or `queue` field changed: remove from old position in `pendJobs`, re-insert at correct position per ordering. |
| `begin_session` | Reset iteration cursor to head of `ordq_t queues`. |
| `next_job` | Walk `ordq_t queues` from cursor. For each queue, skip if `sched_queue_is_ready()` returns false. Within queue, walk `ordq_t pendJobs`. Return first job where `sched_job_is_ready()` returns true. Advance cursor. Return NULL when all queues and jobs exhausted. |
| `end_session` | No-op for FCFS (iteration state reset in `begin_session`). |
| `on_dispatch` | Remove job from its queue's `ordq_t pendJobs` by jobid. |
| `on_pend` | No-op for FCFS — job remains in `pendJobs`, will be retried next round in same position. |
| `on_config` | NULL — FCFS is config-agnostic. |
| `on_job_rusage` | NULL — FCFS is not resource-aware. |
3. **Internal data structures** — `builtin_fcfs` shall maintain its own private state, not query the core's `sched->queues`/`sched->jobs` during `next_job()`. All candidate management happens in the state-change hooks. This ensures:
- `next_job()` is fast — no core lock acquisition, no hash table scans
- The picker is independently testable — feed hooks, verify `next_job()` order
- Simulation snapshots capture picker state naturally via the hooks already recorded in the event stream
4. **Ordering equivalence** — `builtin_fcfs` shall produce the same job-picking order as today's `fcfs_elect_job`: inter-queue by descending `queue->priority`, intra-queue by `priority desc, queue_time asc`. Behavior with per-queue picker overrides is as specified in Req 5 AC 2.
5. **No dedicated thread** — `builtin_fcfs` shall implement `next_job()` as a synchronous call, not a dedicated thread + `jbuf` cbuf. The picker runs in the core's scheduling thread. `pthread_cancel` cancellation points shall exist in the `next_job()` iteration loop.
6. **Session state** — `end_session()` is a no-op. Iteration state is reset in `begin_session()`. Undispatched jobs remain in `pendJobs` across sessions (they carry over to the next round).
### Requirement 9: No regression to existing allocators, job picker, or HA soak
@ -147,27 +380,162 @@ These are fundamentally different concerns:
#### Acceptance Criteria
1. `seqjob_allocator`'s externally observable allocation behavior (which host a `maxTasks == 1` job lands on, given the same worker/resource state) shall be unchanged after it is rewrapped onto the `xce_host_iter_t` interface.
2. `builtin_fcfs` shall produce the same job-picking order as today's `fcfs_elect_job`, given the same queue and job state.
3. `builtin_strict_priority` shall produce the same inter-queue order as today's `fcfs_elect_job` queue iteration loop.
4. `builtin_flat` shall produce the same effective behavior as today's lack of project scoping — all queues in one flat namespace.
5. The `COMPOUND` and `ALTER` resreq allocation paths (`sched_make_compound_allocation`, `sched_make_alter_allocation` in `scheduler.c`) shall remain unchanged, continuing to call into the per-primary allocation path (now iterator-driven) exactly as they do today.
6. Existing scheduler unit tests (`scheduler` meson test suite) shall continue to pass unmodified in assertions, adjusted only where they directly exercised the removed hardcoded-string or eager-one-shot behavior this feature replaces.
7. A full HA soak (sequential and chaotic `/xce-test-ha` regression) shall show no new job loss, divergence, or liveness stall attributable to this feature, confirming the scheduler-side change does not perturb controller-side commit/replication behavior it reads state from.
2. `builtin_fcfs` shall produce the same job-picking order as today's `fcfs_elect_job`, given the same queue and job state — same inter-queue priority ordering and same intra-queue (priority desc, queue_time asc) ordering.
3. The `COMPOUND` and `ALTER` resreq allocation paths (`sched_make_compound_allocation`, `sched_make_alter_allocation` in `scheduler.c`) shall remain unchanged, continuing to call into the per-primary allocation path (now iterator-driven) exactly as they do today.
4. Existing scheduler unit tests (`scheduler` meson test suite) shall continue to pass unmodified in assertions, adjusted only where they directly exercised the removed hardcoded-string, dedicated picker thread, `jbuf` cbuf, or eager-one-shot behavior this feature replaces.
5. A full HA soak (sequential and chaotic `/xce-test-ha` regression) shall show no new job loss, divergence, or liveness stall attributable to this feature, confirming the scheduler-side change does not perturb controller-side commit/replication behavior it reads state from.
### Requirement 10: Core/Driver Separation with Dual-Mode Operation
**Objective:** As a scheduler developer, I want the scheduling core separated from all external I/O so that the same core logic runs deterministically in production (driven by a live controller) and in simulation (driven by recorded cluster events with a discrete event-driven virtual clock), enabling policy debugging, tuning, regression testing, and what-if analysis without a live cluster.
#### Acceptance Criteria
**Core Interface Contract**
1. **Mode-agnostic core**: The Scheduler core shall have no concept of which mode it runs in. It processes events identically whether the driver is in normal mode (controller-connected, wall-clock time) or simulation mode (replay file, virtual clock). Specifically:
- There shall be no mode flag (`bool simulation_mode` or equivalent) anywhere in the core
- There shall be no `if (simulation) { ... } else { ... }` code path in the core
- `xce_sched_core_init()` shall take identical parameters regardless of mode (no mode-specific init arguments)
- The core's decision callback shall be the same function pointer type in both modes — the driver decides what to do with decisions (publish to controller vs. log to file)
- The core's `save_snapshot()` and `load_snapshot()` shall be identical in both modes — they serialize/deserialize core state, not driver state
2. **Passive event-driven interface**: The core shall expose a pure event-driven interface — it receives typed events from the driver, updates internal scheduling state, and emits decisions through a driver-registered callback. The core shall have zero direct dependency on: controller communication, capnp serialization, network I/O, filesystem access, or wall-clock time sources.
3. **Virtualized clock access**: The core shall access time exclusively through `xce_core_now()`. The core shall never call `time(NULL)`, `clock_gettime()`, `gettimeofday()`, or any other wall-clock time function directly.
**Clock virtualization mechanism — two-base + speed formula:**
The core stores three fields (atomically updated by the driver as a group):
| Field | Type | Description |
|-------|------|-------------|
| `virtual_clock_base` | `_Atomic uint64_t` | Virtual-time anchor (nanoseconds) |
| `real_clock_base` | `_Atomic uint64_t` | Wall-clock anchor captured when `virtual_clock_base` was set (nanoseconds, `CLOCK_MONOTONIC`) |
| `speed_num` / `speed_den` | `_Atomic uint64_t` | Speed multiplier as rational fraction |
`xce_core_now(core)` computes:
```c
uint64_t wall_ns = clock_gettime(CLOCK_MONOTONIC); // only wall-clock call in the core
uint64_t elapsed = wall_ns - core->real_clock_base;
return core->virtual_clock_base + (elapsed * core->speed_num) / core->speed_den;
```
| Mode | `virtual_clock_base` | `real_clock_base` | `speed` | Behavior |
|------|----------------------|-------------------|---------|----------|
| Normal | 0 | 0 | 1/1 | `xce_core_now()` = wall clock (degraded: `0 + (wall - 0) × 1`) |
| Simulation discrete | event `ts` | wall at load | 0/1 | `xce_core_now()` = frozen at event `ts` (time does not advance between events) |
| Simulation real-time | snapshot `ts` | wall at load | 1/1 | `xce_core_now()` tracks wall clock from virtual anchor |
| Simulation fast/slow | snapshot `ts` | wall at load | N/1 or 1/N | `xce_core_now()` runs N× faster or slower than wall clock |
The driver atomically updates all three fields before each event dispatch. In simulation discrete mode (speed=0/1), the clock jumps directly from one event `ts` to the next — no continuous advancement. In normal mode (bases=0, speed=1/1), the formula degrades to returning wall-clock time directly, with zero overhead beyond the single `clock_gettime()` call.
**Multi-thread safety**: `xce_core_now()` reads atomic fields lock-free. Both picker and allocator threads independently compute the same virtual time from the shared bases — no mutex needed. The driver updates all three fields as an atomic group (via a single mutex or sequenced atomic stores with a version counter).
- All internal time uses go through `xce_core_now()`: scheduling logic (job queue-time ordering, session boundaries, pend-reason timestamps, job aging), **logging** (log message timestamps via tlog format function), **error messages**, **debug traces** — any code path that needs the current time calls `xce_core_now()`
- Job `sub_time` and `queue_time` are set by the driver (from `xce_core_now()` in normal mode, from event `ts` in simulation mode) before pushing the `JOBS_PUSH` event — the core never generates timestamps for externally-visible fields
- This virtualization is what enables deterministic replay: the same event file produces the same `xce_core_now()` return values (and therefore same log timestamps, same scheduling decisions) regardless of wall-clock speed
- **Third-party library constraint**: any library linked into the scheduler core that needs the current time must obtain it through `xce_core_now()` or a core-provided wrapper — never by calling `time()`, `clock_gettime()`, `gettimeofday()`, or similar directly. Specifically:
- **Logging (tlog)**: The `tlog` library internally captures `struct tlog_time` from wall-clock time before calling the registered format callback (`my_tlog_format`). The core shall register its own format function via `tlog_reg_format_func(fn, core_ptr)` where `core_ptr` is the `xce_sched_core_t*`. This format function shall ignore `info->time` entirely and instead read `xce_core_now(core_ptr)`, converting nanoseconds to `struct tm` fields via `gmtime_r()` (deterministic — pure computation from an integer, no system clock access). The `userptr` parameter of `tlog_reg_format_func()` carries the core pointer into the format callback.
- **libxce subset**: The core shall link only against the minimal data-structure subset of libxce (`ordq`, `dataq`, `cbuf`, `xlist`, `zarray`, `kvmgr`, `rtti`) — not against `netio`, `delay`, `xceapi`, or `idgen` which call wall-clock time internally
- **pthread timed-blocking**: The core is multi-threaded (picker + allocator threads). In simulation mode, thread interleaving is made deterministic per AC 6 — `pthread_cond_timedwait()` and `pthread_mutex_timedlock()` are not needed in the deterministic execution path
- If a library cannot avoid calling wall-clock time directly (e.g., a third-party compression or serialization library that internally timestamps), it must not be linked into the core; such concerns stay in the driver layer
4. **Core event types**: The core interface shall accept at minimum these input events:
| Event Type | Payload | Description |
|------------|---------|-------------|
| `CONFIG_PUSH` | `xce_conf4sched_t*` | Full configuration push (startup or config change) |
| `JOBS_PUSH` | `int njobs, xce_job_t**` | Newly submitted jobs |
| `WORKERS_PUSH` | `int nworkers, xce_worker_t**` | Worker list update |
| `RESOURCES_PUSH` | `int n, xce_resource_t**` | Resource definitions |
| `RESVALS_FULL` | `int n, xce_resval_t**` | Full resource value snapshot |
| `RESVALS_DELTA` | `xce_resval_list_t*` | Incremental resource value update |
| `JOB_STATE_CHANGE` | `uint64_t jobid, uint32_t state` | Job started / exited / failed |
| `JOB_UPDATE` | `xce_job_t*` | In-place job field update (notify path) |
| `QUEUE_UPDATE` | `xce_queue_t*` | Queue definition update |
| `JOB_RUSAGE` | `xce_job_rusages_t*` | Job resource usage update |
| `BEGIN_ROUND` | `uint64_t timestamp_ns` | Trigger scheduling round at given logical time |
5. **Decision output callback**: The core shall emit all scheduling decisions (`DISPATCH`, `PEND`, `PREEMPT`) through a `xce_core_decision_cb_t` callback function pointer registered by the driver at core init time, replacing the current internal `decisions` cbuf + `main.c` poll loop pattern. The callback signature shall be `int (*on_decision)(void* driver_ctx, xce_decision_t* decision)`.
6. **Deterministic guarantee**: Given identical initial state and identical event sequences with identical timestamps, the core shall produce identical decision sequences. The core is multi-threaded (picker thread + allocator thread, matching today's architecture). To achieve deterministic replay:
- All hash table / key-value store iteration that affects scheduling output order shall be stabilized (sorted by key before iterating)
- Any required randomness (e.g., tie-breaking) shall use a PRNG seeded by the driver at init time
- In simulation mode, thread interleaving shall either be made deterministic (e.g., the simulation driver serializes event dispatch and decision collection through a single-threaded core path), or the core's threads shall synchronize on a simulation barrier that advances in lock-step with the virtual clock
7. **Driver event queue**: The driver shall retain an internal pending-event queue (the existing `xce_sched_update_request_t` / `pend_updates` mechanism, or equivalent) to buffer events received from the controller between scheduling rounds. Events accumulate in the driver between `BEGIN_ROUND` invocations. When the core receives `BEGIN_ROUND`, it drains all buffered events, processes a scheduling session, and emits decisions.
**Normal-Mode Driver**
8. **Controller integration**: The normal-mode driver shall receive capnp push/notify messages from the controller (via the existing `scheduler_req_handler` callback), translate each to the corresponding core event type, and invoke the core's event push interface. The driver shall publish core-emitted decisions back to the controller via the existing `xcecli_ctx_t` API (`sched_publish_dispatch` / `sched_publish_pend_reason` semantics, generalized to include `PREEMPT`).
9. **Runtime recording control via xceadmin**: The scheduler shall support two new xceadmin commands:
- `scheduler record start [FILE]` — take a full state snapshot, write it to the replay file, then begin recording all subsequent core input events and output decisions to the file
- `scheduler record stop` — stop recording, close the replay file, resume normal operation
Recording shall have zero impact on scheduling correctness — the core processes identically whether recording is active or not.
10. **Periodic snapshot during recording**: While recording is active, the driver shall periodically append fresh snapshots to the replay file (default: every `N` events, configurable via `--record-snapshot-interval N`, where N=0 disables periodic snapshots and records only the initial snapshot). This bounds replay time for any desired start point.
**Simulation-Mode Driver**
11. **Simulation mode startup**: The scheduler shall support a simulation mode activated by `--sim FILE` (replay file path) and `--sim-start-ts TIMESTAMP` (logical time to begin replay, default: start of file). In simulation mode, the driver loads the most recent snapshot with `ts <= --sim-start-ts`, then replays all delta events from that point forward.
12. **Discrete event-driven virtual clock**: The simulation driver shall implement a virtual clock that advances by jumping directly to the timestamp of the next queued event — no fixed tick interval, no wall-clock waiting between events. The clock shall be strictly monotonically increasing. When multiple events share the same timestamp, they shall be delivered in file order. The driver shall support:
- `--sim-speed N` — rate limit: N=0 means "as fast as possible" (no delay), N=1 means real-time, N>1 means N× real-time
- `--sim-pause-at TIMESTAMP` — pause simulation at a specific logical time for interactive debugging
13. **Deterministic replay verification**: In simulation mode with `--sim-verify`, the driver shall compare each core-emitted decision against the recorded decisions in the replay file. Any mismatch (missing, extra, or different decision) shall be reported as a regression with exact logical-time and decision-detail context.
14. **What-if branching**: The simulation driver shall accept `--sim-alt-events FILE` (alternative delta event file). When both a base replay file (for snapshot loading) and an alt-events file are provided, the driver loads the snapshot from the base file, then replays delta events from the alt-events file — enabling "what-if" analysis (e.g., "what if job X had been submitted with higher priority?").
**Replay File Format**
15. **JSONL format**: The replay file shall be newline-delimited JSON (JSONL), one event per line:
```jsonl
{"type":"HEADER","version":"x.y.z","config_hash":"sha256...","start_ts":1234567890000000000,"start_wall":"2026-07-27T12:00:00Z"}
{"type":"SNAPSHOT","ts":1234567890000000000,"data":{...full core state...}}
{"type":"CONFIG_PUSH","ts":1234568000000000000,"payload":{...}}
{"type":"JOBS_PUSH","ts":1234568100000000000,"payload":{"njobs":2,"jobs":[...]}}
{"type":"BEGIN_ROUND","ts":1234568200000000000,"payload":{}}
{"type":"DECISION","ts":1234568200000000000,"payload":{"op":"DISPATCH","jobid":"..."}}
```
- `type`: event type name string
- `ts`: nanosecond logical timestamp (monotonic, unsigned 64-bit integer)
- `payload`: event-type-specific object
- `HEADER` line: first line of every file, carries scheduler version and configuration hash for compatibility checking
- `SNAPSHOT` lines: embed full core state in `data` (plain JSON, not base64-encoded — debuggable and directly extractable)
- `DECISION` lines: recorded decisions (output), present only in files produced by the normal-mode driver's recording feature — the simulation driver ignores them unless `--sim-verify` is active
- The event payload JSON schema is an open design question deferred to the design phase
**State Snapshot**
16. **Snapshot serialization**: The core shall support `save_snapshot()` producing a full state dump (plain JSON) containing all config, queues (with per-queue picker/preemption settings), jobs (with state, priority, queue-time, resreq), workers (with available/used resources), resources, resvals, users, projects, shared-resource tracking state, unsatisfiable-resreq cache, and session state. The core shall support `load_snapshot()` restoring to that exact state, producing a core that is indistinguishable from one that reached that state by replaying all events up to that timestamp.
**Interaction with Existing Requirements**
Reqs 1–9 describe logic **inside** the core — the picker loop, iterators, parjob allocator, preemption policy, resreq cache, and builtin plugins all operate within the core's event-driven boundary. Requirement 10 defines the boundary itself. Specifically:
- Req 5 (picker slots from config): config arrives via `CONFIG_PUSH` event, not via capnp decode inside the core
- Req 6 (preemption → controller): `XCE_DECISION_PREEMPT` is emitted through the decision callback, not sent directly to controller
- Req 7 (resreq cache, session lifecycle): `BEGIN_ROUND` replaces the implicit `sleep(1)`-delimited session boundary in `main.c`; the cache still lives on `xce_sched_core_t` and is cleared at session start
- Req 9 (HA soak regression): the same core code can be validated in simulation mode against recorded HA failover traces, catching regressions without a live cluster
## Data Structure Changes Summary
### `xce_scheduler_t` additions
```c
char* project_pick_plugin; // default: "builtin_flat"
char* queue_pick_plugin; // default: "builtin_strict_priority"
char* job_pick_plugin; // default: "builtin_fcfs" (global fallback)
char* job_pick_plugin; // default: "builtin_fcfs" (Req 5)
// unsatisfiable resreq cache (Req 7)
```
### `xce_sched_queue_t` additions
```c
char* project_name; // owning project (for Level 1 scoping)
char* job_pick_plugin; // intra-queue picker (NULL = inherit)
char* project_name; // owning project (picker uses internally)
char* job_pick_plugin; // per-queue picker override (NULL = use global)
char** preemptible_queues; // queues this queue CAN preempt from
int n_preemptible_queues;
bool preemptible; // CAN this queue's jobs BE preempted?
@ -176,11 +544,23 @@ char* preempt_policy; // victim selection plugin (NULL = default)
### `xce_sched_project_t` additions
```c
char* job_pick_plugin; // per-project picker (NULL = inherit, v1 field, v2 logic)
int32_t priority; // inter-project ordering (future spec)
// future: resource_quota, resource_used, parent_project (project-resource-ownership spec)
```
### `xce_job_picker_iface_t` (new, Req 1)
```c
typedef struct {
int (*init)(void* picker, xce_sched_core_t* core);
void (*fini)(void* picker);
int (*begin_session)(void* picker);
xce_sched_job_t* (*next_job)(void* picker);
int (*end_session)(void* picker);
int (*on_dispatch)(void* picker, uint64_t jobid);
int (*on_pend)(void* picker, uint64_t jobid);
} xce_job_picker_iface_t;
```
### `decision.h` additions
```c
typedef enum {
@ -199,43 +579,274 @@ typedef struct {
} xce_preempt_decision_t;
```
### Core/Driver Separation (Req 10)
```c
// Core event (driver → core)
typedef enum {
XCE_CORE_EVENT_CONFIG_PUSH = 0,
XCE_CORE_EVENT_JOBS_PUSH,
XCE_CORE_EVENT_WORKERS_PUSH,
XCE_CORE_EVENT_RESOURCES_PUSH,
XCE_CORE_EVENT_RESVALS_FULL,
XCE_CORE_EVENT_RESVALS_DELTA,
XCE_CORE_EVENT_JOB_STATE_CHANGE,
XCE_CORE_EVENT_JOB_UPDATE,
XCE_CORE_EVENT_QUEUE_UPDATE,
XCE_CORE_EVENT_JOB_RUSAGE,
XCE_CORE_EVENT_BEGIN_ROUND,
} xce_core_event_type_t;
typedef struct {
xce_core_event_type_t type;
uint64_t ts; // driver-supplied logical time (ns)
union {
xce_conf4sched_t* config;
struct { int njobs; xce_job_t** jobs; } job_push;
struct { int nworkers; xce_worker_t** workers; } worker_push;
struct { int n; xce_resource_t** resources; } resource_push;
struct { int n; xce_resval_t** vals; } resval_full;
xce_resval_list_t* resval_delta;
struct { uint64_t jobid; uint32_t state; } job_state;
xce_job_t* job_update;
xce_queue_t* queue_update;
xce_job_rusages_t* job_rusage;
// BEGIN_ROUND has no payload beyond ts
} payload;
} xce_core_event_t;
// Decision callback (core → driver)
typedef int (*xce_core_decision_cb_t)(void* driver_ctx, xce_decision_t* decision);
// Core struct (pure scheduling state, no I/O)
typedef struct {
// Scheduling state (moved from xce_scheduler_t)
xce_conf4sched_t* config;
uint64_t configver;
var plugins;
void* seqjob_allocator;
void* parjob_allocator;
void* affinity_allocator;
void* gpu_allocator;
var resmgr, ugmgr, qgmgr, pgmgr, hgmgr;
zarray_t sharedInst, sharedInUse;
var jobs, queues, workers, users, projects;
uint64_t nextid;
// New fields for core/driver boundary
void* driver_ctx; // opaque driver context for callback
xce_core_decision_cb_t on_decision; // decision output callback
// Clock virtualization (Req 10 AC 3) — atomically updated by driver
_Atomic uint64_t virtual_clock_base; // virtual-time anchor (ns)
_Atomic uint64_t real_clock_base; // wall-clock anchor (ns, CLOCK_MONOTONIC)
_Atomic uint64_t speed_num; // speed numerator
_Atomic uint64_t speed_den; // speed denominator
uint64_t prng_seed; // seeded by driver at init
// Picker plugin slot (Req 5)
char* job_pick_plugin; // default: "builtin_fcfs"
// per-queue overrides stored on xce_sched_queue_t.job_pick_plugin,
// read by the picker internally — not separate core slots
// Unsatisfiable resreq cache (Req 7)
// ... (session-level fingerprint cache)
// Session state
_Atomic int session_active;
_Atomic int eval_in_progress;
select_eval_ctx_t* sel_eval_ctx;
} xce_sched_core_t;
// Normal-mode driver
typedef struct {
xce_sched_core_t core;
xcecli_ctx_t apictx; // controller API client
xce_cluster_config_t cluster_cfg; // HA candidate list
dataq_t* pend_updates[2]; // event buffer between rounds
// Recording state
FILE* record_file;
bool recording;
uint64_t record_snapshot_interval;
uint64_t events_since_snapshot;
} xce_sched_driver_t;
// Simulation-mode driver
typedef struct {
xce_sched_core_t core;
FILE* replay_file;
uint64_t virtual_clock; // current logical time (ns)
uint64_t sim_speed; // 0=unlimited, 1=real-time, N=N×
uint64_t pause_at_ts; // 0=don't pause
bool verify; // compare decisions vs recorded
FILE* alt_events_file; // for what-if branching
} xce_sched_sim_driver_t;
// Core interface
int xce_sched_core_init(xce_sched_core_t* core, xce_core_decision_cb_t cb,
void* driver_ctx, uint64_t prng_seed);
int xce_sched_core_push_event(xce_sched_core_t* core, xce_core_event_t* event);
uint64_t xce_core_now(xce_sched_core_t* core); // virtualized clock accessor
int xce_sched_core_save_snapshot(xce_sched_core_t* core, FILE* out);
int xce_sched_core_load_snapshot(xce_sched_core_t* core, FILE* in);
void xce_sched_core_fini(xce_sched_core_t* core);
```
## Architecture Diagram
### Core Scheduling Loop
```
┌──────────────────────────────────────────────────────────┐
│ Level 0: Project Picker [sched->project_pick_plugin] │
│ SCHEDULER CORE LOOP │
│ │
│ v1 (builtin_flat): yields one "default" project │
│ v2 (future): quota-aware project selection │
└──────────────────────┬───────────────────────────────────┘
│ project scope
▼
┌──────────────────────────────────────────────────────────┐
│ Level 1: Inter-Queue Picker [sched->queue_pick_plugin] │
│ │
│ Iterates queues scoped to the selected project │
│ Default: strict_priority (descending queue->priority) │
└──────────────────────┬───────────────────────────────────┘
│ queue
▼
┌──────────────────────────────────────────────────────────┐
│ Level 2: Intra-Queue Picker [queue→project→sched] │
│ │
│ Picks one job from the selected queue │
│ Default: builtin_fcfs (priority desc, queue_time asc) │
└──────────────────────┬───────────────────────────────────┘
│ job
▼
┌──────────────────────────────────────────────────────────┐
│ Allocation + Preemption │
│ │
│ plan_iter → host_iter → try_alloc │
│ success → dispatch │
│ fail → Level 3: preempt? → select victims → SIGSTP │
│ → pend (no preemption possible) │
│ begin_session() │
│ │ │
│ ▼ │
│ ┌──────────────────────┐ │
│ │ picker->next_job() │ ←─ plugin decides HOW │
│ │ returns job or NULL │ (FCFS, priority, fair-share, │
│ └──────────┬───────────┘ deadline, ...) │
│ │ │
│ job │ NULL (exhausted) │
│ ▼ ▼ │
│ ┌──────────────────┐ end_session() → sleep → next round │
│ │ try_allocate(job) │ │
│ └────────┬─────────┘ │
│ │ │
│ success │ fail │
│ ▼ ▼ │
│ ┌────────────┐ ┌────────────────┐ │
│ │ DISPATCH │ │ can_preempt? │ │
│ │ on_dispatch│ │ yes → PREEMPT │ │
│ └────────────┘ │ no → PEND │ │
│ │ on_pend │ │
│ └────────────────┘ │
│ │ │
│ ▼ │
│ next_job() (loop continues) │
└──────────────────────────────────────────────────────────┘
```
### `builtin_fcfs` Internal Design
The default picker plugin internally implements the equivalent of today's selection logic. This is **not** part of the core loop — it's the plugin's private implementation:
```
builtin_fcfs.next_job():
┌────────────────────────────────────────────┐
│ Iterate queues by priority (descending) │
│ Skip queues with no ready jobs │
│ │
│ For each queue: │
│ If queue has per-queue picker override: │
│ Delegate to that picker │
│ Else: │
│ Iterate jobs by priority desc, │
│ queue_time asc (FCFS) │
│ Skip jobs not ready │
│ Return first ready job │
│ │
│ Return NULL if all queues exhausted │
└────────────────────────────────────────────┘
```
## Core/Driver Architecture (Req 10)
```
┌──────────────────────────────────────────────────────────────────┐
│ DRIVER LAYER │
│ │
│ ┌──────────────────────┐ ┌────────────────────────────┐ │
│ │ NORMAL MODE │ │ SIMULATION MODE │ │
│ │ │ │ │ │
│ │ controller capnp ────┐│ │ replay.jsonl ──────────┐ │ │
│ │ (scheduler_req_ ││ │ (event file) │ │ │
│ │ handler) ││ │ │ │ │
│ │ │ ││ │ │ │ │ │
│ │ ▼ ││ │ ▼ │ │ │
│ │ ┌──────────────┐ ││ │ ┌──────────────┐ │ │ │
│ │ │ event queue │ ││ │ │ virtual clock│ │ │ │
│ │ │ (pend_updates)│ ││ │ │ (discrete │ │ │ │
│ │ └──────┬───────┘ ││ │ │ event-driven)│ │ │ │
│ │ │ ││ │ └──────┬───────┘ │ │ │
│ │ │ events ││ │ │ events │ │ │
│ │ │ + BEGIN_ROUND││ │ │ + BEGIN_ROUND │ │ │
│ │ ▼ ││ │ ▼ │ │ │
│ │ ┌──────────────┐ ││ │ ┌──────────────┐ │ │ │
│ │ │ publish │ ││ │ │ record/log │ │ │ │
│ │ │ decisions to │ ││ │ │ decisions │ │ │ │
│ │ │ controller │ ││ │ │ (--sim-verify)│ │ │ │
│ │ └──────▲───────┘ ││ │ └──────▲───────┘ │ │ │
│ │ │ decisions ││ │ │ decisions │ │ │
│ └─────────┼─────────────┘│ └─────────┼───────────────┘ │
│ │ │ │ │
│ │ xce_core_decision_cb_t │ │
│ │ (callback) │ │
└────────────┼──────────────────────────────────┼───────────────────┘
│ │
▼ ▼
┌──────────────────────────────────────────────────────────────────┐
│ SCHEDULER CORE │
│ (xce_sched_core_t) │
│ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ xce_sched_core_push_event(core, event) │ │
│ │ │ │
│ │ Event types: CONFIG_PUSH, JOBS_PUSH, WORKERS_PUSH, │ │
│ │ RESOURCES_PUSH, RESVALS_FULL, RESVALS_DELTA, │ │
│ │ JOB_STATE_CHANGE, JOB_UPDATE, QUEUE_UPDATE, │ │
│ │ JOB_RUSAGE, BEGIN_ROUND │ │
│ └──────────────────────────┬──────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Internal Scheduling Logic (Reqs 1–9) │ │
│ │ │ │
│ │ picker->next_job() → try_allocate(job) │ │
│ │ │ │ │ │
│ │ │ xce_alloc_plan_iter_t │ │ │
│ │ │ → xce_host_iter_t │ │ │
│ │ │ → try alloc │ │ │
│ │ │ │ │ │
│ │ │ success → DISPATCH │ │ │
│ │ │ fail → PREEMPT or PEND │ │ │
│ │ │ → picker->on_dispatch() │ │ │
│ │ │ → picker->on_pend() │ │ │
│ │ │ │ │ │
│ │ Preemption (if alloc fails): │ │
│ │ select victims → SIGSTP → pend job → retry next round │ │
│ │ Resreq fingerprint cache (per-session) │ │
│ └──────────────────────────┬──────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ on_decision(driver_ctx, decision) │ │
│ │ DISPATCH / PEND / PREEMPT │ │
│ └─────────────────────────────────────────────────────────────┘ │
│ │
│ ZERO dependencies on: controller, capnp, network, wall-clock │
└──────────────────────────────────────────────────────────────────┘
```
### Simulation Replay Sequence
```
load snapshot replay delta events
│ │
▼ ▼
┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ HEADER │───▶│ SNAPSHOT │───▶│ EVENT @t1 │───▶│ EVENT @t2 │───▶ ...
└──────────┘ └──────────┘ └──────────┘ └──────────┘
│ │ │
▼ ▼ ▼
restore core push + BEGIN_ push + BEGIN_
state via ROUND(t1) → ROUND(t2) →
load_snapshot emit decisions emit decisions
Virtual clock: t_snap ────────▶ t1 ───────────▶ t2 ───────────▶
(discrete jumps, no wall-clock delay, monotonic)
```
## Preemption Flow
```
@ -261,15 +872,15 @@ XCE_DECISION_PREEMPT ────────────▶ handle_job_preempt(
J pended → next scheduling round → allocation retries on freed resources
```
## Future: Project Resource Ownership (Level 0 full)
## Future: Project Resource Ownership
Deferred to a separate `project-resource-ownership` spec. When implemented:
- Projects form a tree with resource quota at each node
- Level 0 project picker selects which project gets resources (fair-share, priority, proportional)
- Level 1 queue picker is scoped to the selected project's queues
- Level 2 job picker sees only jobs from the selected project within each queue
- Project quota enforcement: projects over quota are skipped by Level 0
- The unified picker loop (Requirement 1) requires zero code changes — only a new project picker plugin replaces `builtin_flat`
- A project-aware picker plugin selects which project gets resources (fair-share, priority, proportional), then iterates queues scoped to that project, then jobs within each queue
- Project quota enforcement: projects over quota are skipped by the picker
- The core scheduling loop (Requirement 1) requires zero code changes — only a new picker plugin replaces `builtin_fcfs`. The core still calls `picker->next_job()` with no knowledge of projects.
- `queue->project_name` (added here) provides the queue→project mapping the v2 picker consumes
- `xce_sched_project_t` scaffolding (added here) provides the struct the v2 picker extends with quota/usage fields
The architecture is designed so that v1 (flat) and v2 (hierarchical) share the identical scheduling loop. The only difference is which project picker plugin is configured.
The architecture is designed so that v1 (flat, `builtin_fcfs` ignores projects) and v2 (hierarchical, project-aware picker) share the identical core scheduling loop. The only difference is which picker plugin is configured.

8
.kiro/specs/scheduler-framework/spec.json
View file

@ -1,9 +1,10 @@
{
"feature_name": "scheduler-framework",
"created_at": "2026-07-09T21:20:00Z",
"updated_at": "2026-07-10T10:00:00Z",
"updated_at": "2026-07-27T00:00:00Z",
"language": "en",
"phase": "requirements-generated",
"phase": "decomposed",
"description": "DECOMPOSED into scheduler-core, scheduler-allocation, scheduler-preemption. This spec is retained for discovery context; see child specs for active requirements.",
"approvals": {
"requirements": {
"generated": true,
@ -19,5 +20,6 @@
}
},
"ready_for_implementation": false,
"blocked_on": []
"blocked_on": [],
"child_specs": ["scheduler-core", "scheduler-allocation", "scheduler-preemption"]
}