Summary

Track 1, item 2 from docs/AGENT_OPERATIONS.md — activate the dead-code supervisor module. The daemon can now spawn + supervise its own llama-server instead of requiring the user to hand-run it, with health-gated restart, exponential backoff, max-restart budget, and a Tauri status command for the UI to surface failure.

Ollama is intentionally not supervised here (it has its own service installer + lifecycle); the spawn-gate refuses when backend = "ollama", and the module doc explains why.

What changed

Rust (crates/ocm-daemon/)

• settings — one new field: llama_server_binary: Option<String>. #[serde(default)] for forward-compat. Doc explicitly notes "no-op when backend = ollama".
• supervisor — was already a partial module (Supervisor struct, spawn helpers, wait_for_http_ready); now activated. Added:
  • SupervisorStatus enum (Serialize, snake_case tag): NotSpawning / Starting / Running { pid } / Restarting { attempt, last_error } / FailedAfterMaxRestarts { attempts, last_error } / Stopped.
  • SupervisorPolicy with defaults: max_restarts=3, initial_backoff=500ms, max_backoff=10s, stability_window=60s, health_check_interval=5s, health_check_timeout=15s.
  • compute_backoff(attempt, initial, max) — exponential, u8::MAX-safe (no shift overflow).
  • supervise(supervisor, policy, status, shutdown) — health-gated restart loop. Every wait is tokio::select!-raced against the shutdown signal. Stability-window reset means a process that ran healthy then crashed isn't penalized as a flap. tracing::error when the budget is exhausted.
  • Module-level doc clarifies Ollama no-spawn (own service installer; we'd fight ollama-svc's restart logic).
  • spawn_vllm_server kept (already tested) but explicitly #[allow(dead_code)] — NVIDIA supervision is a separate follow-up.
• bootstrap — wire-points:
  • should_spawn_llama_supervisor(settings, models_dir) -> bool — the spawn-gate decision: requires backend = LlamaCpp AND llama_server_binary.is_some() AND the model GGUF exists at models_dir/<model_id>.gguf (matching ocm_models::downloader convention). Six test cases cover the matrix.
  • build_llama_supervisor(settings, models_dir) -> Option<(Arc<Supervisor>, SupervisorPolicy)> — resolves binary + model path + port (from inference_base_url) + health URL (/v1/models), returns None when the gate refuses.
  • LlamaSupervisorState — what main.rs app.manage()s. Holds the shared status Arc<Mutex<_>> plus the shutdown watch::Sender (in Mutex<Option<_>> so a future RunEvent::ExitRequested hook can .take() it). Dropping the state is sufficient for clean shutdown in v0.1.2; signal_shutdown stub is included for the future hook.
• commands — get_supervisor_status Tauri command, returns the live SupervisorStatus.
• main — supervisor wired into setup(): build → spawn supervise loop on tauri runtime → app.manage(supervisor_state). Falls cleanly back to NotSpawning when the gate refuses. Removed the #[allow(dead_code)] mod supervisor; annotation (it's live now).

Frontend — Settings interface gains llama_server_binary; settings page gains a path input with placeholder communicating None=do-not-spawn.

TDD audit trail

New test coverage (+17 tests)

• supervisor.rs (+5): SupervisorStatus::default(); SupervisorPolicy::default() lockstep with constants; compute_backoff schedule (incl. u8::MAX safety); supervise() integration Phase 1: Foundation — Tauri shell, paths, settings, CI #1: immediate-exit Command + unresponsive health URL → exactly max_restarts=2 attempts → FailedAfterMaxRestarts; supervise() integration Phase 0: Bench framework scaffold + first isolation sandbox #2: long-running sleep + early shutdown signal → Stopped + child reaped.
• settings.rs (+3): default llama_server_binary == None; TOML round-trip; legacy file (no field) still parses.
• bootstrap.rs (+9): full spawn-gate decision matrix (6 cases — yes / Ollama-no / Auto-no / binary-None-no / file-missing-no / model_id-None-no), parse_port helper (2 cases), build_llama_supervisor returns None when gate refuses.

ocm-daemon test count: 25 → 42 (verified in run 27381788960 log).

Design choices made

Per AGENT_OPERATIONS "NEEDS_APPROVAL when not covered by spec": the operator declined the multi-choice up front, so I took my own recommended paths and documented them:

• Status surface: new Tauri command get_supervisor_status + tracing::error on FailedAfterMaxRestarts. No tray-icon hint, no UI panel in this PR (UI polish = Track 1 item 3).
• ctx_len: hardcoded DEFAULT_LLAMA_CTX_LEN = 4096 const (matches implementation-plan example). No new Settings field; revisit in item 3 if needed.
• Spawn-gate conservatism: if model_id is set but the GGUF doesn't exist on disk, refuse to spawn rather than burn the restart budget on a server with nothing to load. Chat fails loudly via the existing "backend not reachable" message instead.
• Auto backend → no spawn: explicitly opt-in via backend = "llamacpp". Preserves pre-v0.1.2 behavior for users who never opted into supervision.

Test plan

• cargo clippy --workspace --all-targets -- -D warnings — green on ubuntu/macOS/windows (run 27381788960)
• cargo test --workspace — 42 ocm-daemon tests + others green on all 3 platforms (run 27381788960)
• Frontend npm run check — 258 files, 0 errors (local)
• Frontend Frontend CI workflow — green on Node 20 + Node 22 (run 27381591372)
• Manual smoke (operator) — point llama_server_binary at a real binary, download a registry model, launch cargo tauri dev, observe llama-server spawned + supervisord. Not run here (no local Rust toolchain).
• Manual failure-mode smoke (operator) — point at a binary that exits immediately; observe FailedAfterMaxRestarts after 3 attempts via get_supervisor_status (frontend hook is follow-up).

Out of scope (deferred)

• vLLM supervision — spawn_vllm_server helper still exists, still tested, but explicitly not wired (heavier preconditions; separate follow-up).
• RunEvent::ExitRequested hook — current clean-shutdown is Drop-of-watch::Sender (sufficient; the loop notices, calls Supervisor::stop(), sets Stopped). An explicit hook + join-handle wait would be more graceful; signal_shutdown stub is ready for it.
• UI status panel — Tauri command exists, no frontend display yet. Track 1 item 3 territory.

🤖 Generated with Claude Code