Tune tracker workers and bound agent budgets

The tracker-mapping and common-pattern-enrichment workers ran with the
kit/worker defaults (interval 10s, max-concurrency 5 each) and dropped
the resolved per-agent max-tokens/temperature, so up to ten LLM
pipelines could run unbounded on one OpenAI client. The mapping worker
also held a FOR UPDATE transaction across the LLM and Firecrawl calls
while its DB search tools acquired a second pooled connection, risking
pool exhaustion under concurrency.

Plumb max-tokens, temperature, agent timeout, and per-worker max-turns
through TrackerAgentsConfig and DisambiguationConfig into all three
agent builders, replacing the hard-coded constants with config-fed
fields and package fallbacks. Expose worker interval, concurrency,
stale-after, agent timeout, and max-turns as config (env, Helm values,
deployment template) mirroring the evidence-describer pattern, and
apply them at registration.

Refactor Process into deterministic-read, agent (no transaction), and
persist phases so neither the mapping agent nor disambiguation runs
inside an open transaction, removing the row locks held across network
latency and the nested-connection pressure.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/probod/aliases.go

@@ -41,13 +41,17 @@ type (
 	LLMAgentConfig          = probodconfig.LLMAgentConfig
 	EvidenceDescriberConfig = probodconfig.EvidenceDescriberConfig
 	AgentsConfig            = probodconfig.AgentsConfig
-	MailerConfig            = probodconfig.MailerConfig
-	SMTPConfig              = probodconfig.SMTPConfig
-	NotificationsConfig     = probodconfig.NotificationsConfig
-	WebhookConfig           = probodconfig.WebhookConfig
-	OIDCProviderConfig      = probodconfig.OIDCProviderConfig
-	PgConfig                = probodconfig.PgConfig
-	SAMLConfig              = probodconfig.SAMLConfig
-	SCIMBridgeConfig        = probodconfig.SCIMBridgeConfig
-	SlackConfig             = probodconfig.SlackConfig
+
+	TrackerMappingWorkerConfig          = probodconfig.TrackerMappingWorkerConfig
+	CommonPatternEnrichmentWorkerConfig = probodconfig.CommonPatternEnrichmentWorkerConfig
+
+	MailerConfig        = probodconfig.MailerConfig
+	SMTPConfig          = probodconfig.SMTPConfig
+	NotificationsConfig = probodconfig.NotificationsConfig
+	WebhookConfig       = probodconfig.WebhookConfig
+	OIDCProviderConfig  = probodconfig.OIDCProviderConfig
+	PgConfig            = probodconfig.PgConfig
+	SAMLConfig          = probodconfig.SAMLConfig
+	SCIMBridgeConfig    = probodconfig.SCIMBridgeConfig
+	SlackConfig         = probodconfig.SlackConfig
 )

pkg/probod/probod.go

@@ -725,7 +725,14 @@ func (impl *Implm) Run(
 		},
 	)
 
-	trackerMappingWorker := cookiebanner.NewTrackerMappingWorker(pgClient, l, trackerAgentsCfg, thirdPartyDisambiguationCfg)
+	trackerMappingWorker := cookiebanner.NewTrackerMappingWorker(
+		pgClient,
+		l,
+		trackerAgentsCfg,
+		thirdPartyDisambiguationCfg,
+		worker.WithInterval(time.Duration(impl.cfg.TrackerMappingWorker.Interval)*time.Second),
+		worker.WithMaxConcurrency(impl.cfg.TrackerMappingWorker.MaxConcurrency),
+	)
 	trackerMappingWorkerCtx, stopTrackerMappingWorker := context.WithCancel(context.Background())
 
 	wg.Go(
@@ -742,7 +749,17 @@ func (impl *Implm) Run(
 	stopCommonPatternEnrichmentWorker := func() {}
 
 	if trackerAgentsCfg.LLMClient != nil {
-		commonPatternEnrichmentWorker := cookiebanner.NewCommonPatternEnrichmentWorker(pgClient, l, trackerAgentsCfg)
+		enrichmentCfg := trackerAgentsCfg
+		enrichmentCfg.AgentTimeout = time.Duration(impl.cfg.CommonPatternEnrichmentWorker.AgentTimeout) * time.Second
+
+		commonPatternEnrichmentWorker := cookiebanner.NewCommonPatternEnrichmentWorker(
+			pgClient,
+			l,
+			enrichmentCfg,
+			time.Duration(impl.cfg.CommonPatternEnrichmentWorker.StaleAfter)*time.Second,
+			worker.WithInterval(time.Duration(impl.cfg.CommonPatternEnrichmentWorker.Interval)*time.Second),
+			worker.WithMaxConcurrency(impl.cfg.CommonPatternEnrichmentWorker.MaxConcurrency),
+		)
 
 		var commonPatternEnrichmentWorkerCtx context.Context
 

pkg/probod/tracker_agents.go

@@ -16,6 +16,7 @@ package probod
 
 import (
 	"fmt"
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
 	"go.gearno.de/kit/log"
@@ -57,15 +58,34 @@ func (impl *Implm) buildTrackerAgentsConfig(
 		return cookiebanner.TrackerAgentsConfig{}, thirdparty.DisambiguationConfig{}, fmt.Errorf("cannot resolve tracker mapping agent client: %w", err)
 	}
 
+	mappingWorkerCfg := impl.cfg.TrackerMappingWorker
+	enrichmentWorkerCfg := impl.cfg.CommonPatternEnrichmentWorker
+
+	// The mapping and enrichment agents share one config slot but run
+	// from separate workers with separate max-turns. AgentTimeout here
+	// carries the mapping worker's value (also reused by the
+	// disambiguation agent); the enrichment worker overrides it on its
+	// own copy at registration.
 	trackerAgentsCfg := cookiebanner.TrackerAgentsConfig{
-		LLMClient:       llmClient,
-		Model:           agentCfg.ModelName,
-		FirecrawlAPIKey: impl.cfg.Agents.Tools.FirecrawlAPIKey,
+		LLMClient:          llmClient,
+		Model:              agentCfg.ModelName,
+		FirecrawlAPIKey:    impl.cfg.Agents.Tools.FirecrawlAPIKey,
+		MaxTokens:          agentCfg.MaxTokens,
+		Temperature:        agentCfg.Temperature,
+		AgentTimeout:       time.Duration(mappingWorkerCfg.AgentTimeout) * time.Second,
+		MappingMaxTurns:    mappingWorkerCfg.AgentMaxTurns,
+		EnrichmentMaxTurns: enrichmentWorkerCfg.AgentMaxTurns,
 	}
 
+	// The disambiguation agent emits a single id plus a short rationale,
+	// so it keeps its own smaller token budget (left unset here) rather
+	// than inheriting the mapping agent's. It shares the mapping worker's
+	// timeout.
 	disambiguationCfg := thirdparty.DisambiguationConfig{
-		LLMClient: llmClient,
-		Model:     agentCfg.ModelName,
+		LLMClient:   llmClient,
+		Model:       agentCfg.ModelName,
+		Temperature: agentCfg.Temperature,
+		Timeout:     time.Duration(mappingWorkerCfg.AgentTimeout) * time.Second,
 	}
 
 	return trackerAgentsCfg, disambiguationCfg, nil