space-architect 7.1.0 → 8.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17559f544d11b36996a3e8f927a8e4c9d2db3f178687c726fee14793c7ec6de4
-  data.tar.gz: 5b7c00fc0748f05e5c557339d011f3583816399a2261c79ae45e93e3f9e78ae5
+  metadata.gz: b63abfece4c105ef5b2befd0d8c4e4301d8d5cade10570cd2f41bd0641b8c4be
+  data.tar.gz: 6b932ae13952dad48f81a2ee68ed52b7cee28ef8edc4a99e7a06f23952c4f107
 SHA512:
-  metadata.gz: db1f7cf0ed0ce5401483b7f3e2e429e5caf2200d1baeb450940f6afddd017744bd449a5b05dc2cfbbfc70787967ec01b6542adbd301c69e470917f6b8887f41c
-  data.tar.gz: b1c4fb81c6eeb1c9158e77a4e75aa21e01d4d77ac203e448c8ba564c76c2977bff9959fb481f480858a647f52262f3bcc516743220f6113d8a17c3f614f0f5fc
+  metadata.gz: 3cbb55f4fab850bc9fb7b4cf55bb318bf846d54c3f78a399c50b76d325ddbcd12ad52072d224d75a25b6e5830c8fffa6d7e6f51ad522aae231bb2b374ac3980e
+  data.tar.gz: 4adfa615512c8f6652b85d5948c0a58c9851d30711fc2a1a7f870060601bb6fe0fab9af4ade0c8eebfb5e93a67bf60d1d6516e12fcd0ba96595d530049e0d0da

data/CHANGELOG.md

@@ -5,6 +5,60 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.0.0] - 2026-10-09
+
+### Changed
+
+- **pi is the only dispatch harness.** The `claude-code` and `opencode`
+  backends are deleted, along with everything that only served them: the
+  per-harness `DEFAULT_MODELS` map (one `Harness::DEFAULT_MODEL`:
+  `accounts/fireworks/models/glm-5p3-flash`), the three-way thinking-level
+  dispatch, the `--allowed-tools`/`--append-allowed-tools` flags and their
+  #89 resolution machinery (the frozen lanes block records `name`/`repo`/
+  `touch` only), `dispatch --as-job` with its `--host`/`--token`/
+  `--backend-url`/`--job-model`/`--api-key-ref` flags, and the backward-
+  compat `Dispatcher` wrapper. The `Harness.for` seam stays: any name but
+  `pi` — including a stored legacy harness in an old space.yaml — raises an
+  actionable error naming `pi` as the only valid harness. The push kwargs
+  (`--push-url`/`--push-token`/`--push-host`) and `--quiet` now apply to pi
+  dispatches, with liveness lines parsed from pi's own JSONL stream.
+- **`PiHarness` reaches parity with the old default backend:** a liveness
+  line per run (first assistant-role JSONL event carrying `model`; OK when
+  it matches the pin, WARN on no growth / no assistant model within the
+  budget / pinned-vs-streamed mismatch; incremental scan, `--quiet`
+  suppressible), stdout tee through a pipe to the run log and — when push
+  is wired — streamed to the ingest endpoint, and TERM→grace→KILL timeout
+  escalation unchanged.
+- **A vendored builder-guard extension ships with every dispatch.**
+  `lib/space_architect/pi/builder-guard.ts` is copied byte-for-byte into the
+  run's build dir and injected via `pi -e`, denying git-write subcommands
+  (parsed per command segment — `git -C <path> commit` is caught, `git log
+  --grep=commit` passes) and `bash -n`-unparseable commands before they run.
+  The deny reason tells the builder what was denied and what to do instead;
+  the architect CLI owns all commits.
+- **Research runs run on pi too.** The research supervisor constructs a
+  `PiHarness` per run (sessions under `build/research/<id>/`), passes the
+  same vendored guard, and defaults to the pi default model; read-only
+  remains prompt-enforced. `run.detached` research classification keys off
+  pi's terminal assistant `stopReason` instead of a stream-json `result`
+  event.
+
+### Fixed
+
+- **`architect research wait` works on pi runs.** `Research::Mux` and
+  `Research::Renderer` now speak pi's JSONL event vocabulary natively (the
+  last claude-code stream-json dialect in the gem): the tail breaks on
+  `agent_settled`, `wait` classifies via the last assistant `stopReason` plus
+  `agent_settled.aborted` and the final assistant text (no final text →
+  `:failed` "no final assistant text"), and the report is the final assistant
+  message's joined text blocks. The shared pi-shape predicates live in one
+  new module, `Research::PiEvents` (last assistant message/stopReason, joined
+  text, run span from `session.timestamp` → last assistant `timestamp`,
+  `turn_end` count) — `Supervisor#classify` consumes it too. The renderer's
+  §5.3 verbosity ladder, `--thinking`, and `--jsonl` passthrough are
+  unchanged, fed by pi events (`message_end`, `tool_execution_start/end`)
+  with the terminal line built from native facts (no fabricated fields).
+
 ## [7.1.0] - 2026-08-16
 
 One iteration of the Architect Loop (I01, space

data/README.md

@@ -343,7 +343,8 @@ architect integrate my-feature --lanes lane-a    # merge passing lanes → proje
 
 ### Streaming builder output 📡
 
-`architect dispatch` can push the builder's stream-json to an ingest server for
+`architect dispatch` can push the builder's pi JSONL event stream to an ingest
+server for
 live viewing:
 
 ```sh
@@ -367,8 +368,9 @@ can be combined with `--detach` (the push tees the live pipe in-process).
 ### Research lanes 🔭
 
 When an iteration needs facts the repo doesn't already have, fan out parallel
-**read-only** research lanes — detached `claude -p` researchers (no
-Edit/Write/Bash) that you supervise:
+**read-only** research lanes — detached `pi -p --mode json` researchers
+(read-only by prompt contract; the supervisor-injected guard denies git writes)
+that you supervise:
 
 ```sh
 architect research dispatch 01-official-api.prompt.md 02-changelog.prompt.md

data/lib/space_architect/architect_project.rb

@@ -241,13 +241,6 @@ module Space::Architect
           lanes = s["lanes"] || []
           declared.each do |d|
             fields = { "name" => d["name"], "repo" => d["repo"], "touch_set" => Array(d["touch"]) }
-            # #89/AC3-AC4: the frozen lane's own tool grant, reviewable like every other
-            # boundary. Declared-only, like touch_set — worktree_add never touches these
-            # keys, so a re-materialize preserves them without threading them through
-            # recorded_lane_fields (unlike harness/model, which worktree_add resolves and
-            # overwrites on every call).
-            fields["allowed_tools"]        = d["allowed_tools"]        if d["allowed_tools"]
-            fields["append_allowed_tools"] = d["append_allowed_tools"] if d["append_allowed_tools"]
             existing = lanes.find { |l| l["name"] == d["name"] }
             existing ? existing.merge!(fields) : lanes << fields
           end
@@ -841,7 +834,7 @@ module Space::Architect
         variants: variant_lanes.map do |l|
           {
             name:               l["name"],
-            harness:            l["harness"] || "claude-code",
+            harness:            l["harness"] || "pi",
             model:              l["model"],
             effort:             l["effort"],
             base_sha:           l["base_sha"],
@@ -940,9 +933,8 @@ module Space::Architect
       end
     end
 
-    def dispatch(iteration, lane, model: nil, max_turns: 200,
-                 claude_bin: nil, harness: nil, opencode_bin: nil, effort: nil,
-                 allowed_tools: nil, append_allowed_tools: nil, force: false, quiet: false,
+    def dispatch(iteration, lane, model: nil, max_turns: 200, bin: nil, harness: nil, effort: nil,
+                 force: false, quiet: false,
                  detach: false, push_url: nil, push_token: nil, push_host: nil, run_creator: nil,
                  push_client: nil, timeout: nil, prompt: nil, now: Time.now)
       raise Space::Core::Error, "Specify --push-host or --push-url, not both" if push_host && push_url
@@ -959,12 +951,6 @@ module Space::Architect
 
       resolved_harness, resolved_model, resolved_effort =
         resolve_dispatch_harness(lane_entry, model: model, harness: harness, effort: effort, force: force, err: err)
-      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
-        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
-      err.puts(tools_provenance) if replace_tools || append_tools
-
-      raise Space::Core::Error, "--push-host is only supported with the claude-code harness" \
-        if push_host && resolved_harness != "claude-code"
 
       id = iteration_id(entry)
       wt_path = space.path.join(lane_entry["worktree"] || "build/#{id}-#{lane}/wt")
@@ -979,31 +965,31 @@ module Space::Architect
       # and the CLI owns the canonical copy — byte-for-byte, like variant_add.
       copy_and_validate_prompt!(prompt, prompt_path)
 
-      bin = resolved_harness == "claude-code" ? claude_bin : opencode_bin
+      # Vendor the builder guard into the lane's build dir (idempotent overwrite) and
+      # inject it via -e on every dispatch — blocking and detached alike. The guard
+      # denies git-write and bash-unparseable commands before evaluation; the builder
+      # itself never needs to remember to load it.
+      guard_path = build_dir.join("builder-guard.ts")
+      FileUtils.cp(vendored_guard_path, guard_path)
+
       harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns, bin: bin,
                                                   config_dir: build_dir, effort: resolved_effort,
-                                                  allowed_tools: resolved_allowed_tools, force: force, err: err)
+                                                  guard_path: guard_path, force: force, err: err)
 
-      # Stamp launch time and the resolved harness/model/effort/allowed_tools onto the
+      # Stamp launch time and the resolved harness/model/effort onto the
       # lane entry: after every preflight validation has passed (a dispatch that raises
       # above records nothing) and before the blocking run or a detached dispatch
       # returns. A re-dispatch overwrites the prior values, so `architect status`
-      # always reads what actually ran on the last dispatch. #89/AC8: the resolved
-      # tool grant is recorded the same way, so a denial traces back to a grant a
-      # human can read — replace_tools/append_tools are the pre-composition components
-      # (not the harness's expanded ClaudeCodeHarness.resolve_tools result), so a later
-      # bare re-dispatch re-resolves from the same components instead of compounding.
+      # always reads what actually ran on the last dispatch.
       update_architect_block do |b|
         (b["iterations"] || []).each do |s|
           next unless s["name"] == iteration
           (s["lanes"] || []).each do |l|
             next unless l["name"] == lane
-            l["dispatched_at"]         = now.iso8601
-            l["harness"]               = resolved_harness
-            l["model"]                 = resolved_model
-            l["effort"]                = resolved_effort if resolved_effort
-            l["allowed_tools"]         = replace_tools    if replace_tools
-            l["append_allowed_tools"]  = append_tools     if append_tools
+            l["dispatched_at"] = now.iso8601
+            l["harness"]       = resolved_harness
+            l["model"]         = resolved_model
+            l["effort"]        = resolved_effort if resolved_effort
           end
         end
         b
@@ -1028,96 +1014,30 @@ module Space::Architect
 
         run_kwargs = { prompt_path: prompt_path, run_log_path: run_log_path, chdir: wt_path }
         run_kwargs[:timeout] = timeout if timeout
-        if resolved_harness == "claude-code"
-          run_kwargs[:push_url]    = push_url    if push_url
-          run_kwargs[:push_token]  = push_token  if push_token
-          run_kwargs[:push_client] = push_client if push_client
-          run_kwargs[:err]         = err         if quiet
-        end
+        run_kwargs[:push_url]    = push_url    if push_url
+        run_kwargs[:push_token]  = push_token  if push_token
+        run_kwargs[:push_client] = push_client if push_client
+        run_kwargs[:err]         = err         if quiet
         exit_code = harness_obj.run(**run_kwargs)
 
         result = { exit_code: exit_code, run_log: run_log_path, report: report_path, worktree: wt_path }
         result[:prompt_copied]  = prompt_path    if prompt
-        result[:timed_out]      = true           if exit_code == Harness::ClaudeCodeHarness::TIMEOUT_EXIT_CODE
+        result[:timed_out]      = true           if exit_code == Harness::PiHarness::TIMEOUT_EXIT_CODE
         result[:created_run_id] = created_run_id if created_run_id
         result[:push_url]       = push_url       if push_url
         result
       end
     end
 
-    # Submit the lane's builder run as a job to the space-server's queue instead of
-    # running it locally: the sandboxed executor mounts the lane worktree + the repo
-    # checkout at their identical host absolute paths (so the worktree's gitdir
-    # pointer resolves) and runs the harness itself — no local run.jsonl, the
-    # transcript lives server-side. jobs_client: is the injectable seam (mirrors
-    # dispatch's run_creator:).
-    def dispatch_as_job(iteration, lane, host:, token:, backend_url:, model: nil, harness: nil,
-                        max_turns: 200, effort: nil, allowed_tools: nil, append_allowed_tools: nil,
-                        force: false, quiet: false,
-                        job_model: nil, api_key_ref: nil, prompt: nil, jobs_client: nil, now: Time.now)
-      err = quiet ? File.open(File::NULL, "w") : $stderr
-
-      entry = slice_entry(iteration)
-      lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
-      raise Space::Core::Error, "No lane '#{lane}' recorded for iteration '#{iteration}'" unless lane_entry
-      lane_entry = ensure_lane_materialized(iteration, lane)
-
-      resolved_harness, resolved_model, resolved_effort =
-        resolve_dispatch_harness(lane_entry, model: model, harness: harness, effort: effort, force: force, err: err)
-      raise Space::Core::Error, "--as-job only supports the claude-code harness (lane '#{lane}' resolves to '#{resolved_harness}')" \
-        unless resolved_harness == "claude-code"
-      raise Space::Core::Error, "--job-model is required with --as-job" unless job_model
-
-      # #89: same replace/append resolution as the local dispatch path — the sandboxed
-      # executor still runs `claude -p` with harness_args server-side.
-      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
-        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
-      err.puts(tools_provenance) if replace_tools || append_tools
-
-      id = iteration_id(entry)
-      wt_path = space.path.join(lane_entry["worktree"] || "build/#{id}-#{lane}/wt")
-      raise Space::Core::Error, "Worktree directory does not exist: #{wt_path}" unless wt_path.exist?
-
-      build_dir   = space.path.join("build", "#{id}-#{lane}")
-      prompt_path = build_dir.join("prompt.md")
-      copy_and_validate_prompt!(prompt, prompt_path)
-
-      repo_path   = space.path.join("repos", lane_entry["repo"])
-      harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns,
-                                                  effort: resolved_effort, allowed_tools: resolved_allowed_tools,
-                                                  force: force, err: err)
-
-      spec = job_spec(iteration: iteration, lane: lane, wt_path: wt_path, build_dir: build_dir,
-        repo_path: repo_path, prompt_content: prompt_path.read, backend_url: backend_url,
-        job_model: job_model, api_key_ref: api_key_ref, harness_args: harness_obj.builder_args)
-
-      client = jobs_client || JobsClient.new(host, token)
-      job_id = client.create(spec)
-
-      # Dispatch bookkeeping, mirroring the local path's dispatched_at stamp: a
-      # re-dispatch overwrites the prior job_id, so `architect status` always
-      # reflects the last dispatch regardless of mode.
-      update_architect_block do |b|
-        (b["iterations"] || []).each do |s|
-          next unless s["name"] == iteration
-          (s["lanes"] || []).each do |l|
-            next unless l["name"] == lane
-            l["dispatched_at"] = now.iso8601
-            l["job_id"]        = job_id
-          end
-        end
-        b
-      end
-
-      result = { job_id: job_id, spec: spec }
-      result[:prompt_copied] = prompt_path if prompt
-      result
-    end
-
     private
 
     attr_reader :space
 
+    # The vendored builder-guard extension shipped in the gem (lib/space_architect/pi/).
+    def vendored_guard_path
+      Pathname.new(__dir__).join("pi/builder-guard.ts")
+    end
+
     # Compose a commit message. Without a custom message, the canonical default
     # (unchanged). With one, a short canonical prefix keeps the loop's commit
     # taxonomy grep-able while the author's first line owns the subject; any
@@ -1685,23 +1605,23 @@ module Space::Architect
     end
 
     # Resolve harness + model by precedence: explicit value > (dispatch only) the
-    # lane's stored value > space.yaml project.harness/project.model > the
-    # per-harness sensible default (model only, keyed on the resolved harness).
-    # Shared by worktree_add and dispatch so both read the same defaults. A stored
-    # model is only honored when its stored harness still matches the resolved
-    # harness — a dispatch-time harness override drops the old harness's stored
-    # model instead of leaking it into the new harness's run.
+    # lane's stored value > space.yaml project.harness/project.model > the pi
+    # default model. Shared by worktree_add and dispatch so both read the same
+    # defaults. A stored model is only honored when its stored harness still matches
+    # the resolved harness — a dispatch-time harness override drops the old harness's
+    # stored model instead of leaking it into the new harness's run. A stored
+    # legacy harness name survives resolution (so a stale space.yaml
+    # surfaces as Harness.for's actionable pi-only error, not a silent default).
     def resolve_harness_model(harness, model, stored_harness: nil, stored_model: nil)
       defaults = project_defaults
-      resolved_harness = (harness || stored_harness || defaults["harness"] || "claude-code").to_s
+      resolved_harness = (harness || stored_harness || defaults["harness"] || "pi").to_s
       stored_model = nil unless stored_harness.nil? || stored_harness.to_s == resolved_harness
-      resolved_model = model || stored_model || defaults["model"] || Harness.default_model_for(resolved_harness)
+      resolved_model = model || stored_model || defaults["model"] || Harness::DEFAULT_MODEL
       [resolved_harness, resolved_model]
     end
 
     # --prompt: the caller authors the lane prompt anywhere (a fresh scratch file) and
-    # the CLI owns the canonical copy — byte-for-byte, like variant_add. Shared by
-    # dispatch and dispatch_as_job so both refuse the same empty/stub prompt.
+    # the CLI owns the canonical copy — byte-for-byte, like variant_add.
     def copy_and_validate_prompt!(prompt, prompt_path)
       if prompt
         src = Pathname.new(prompt)
@@ -1716,8 +1636,8 @@ module Space::Architect
         if prompt_content.empty? || prompt_content == PROMPT_STUB.strip
     end
 
-    # Resolve harness/model/effort for a dispatch (local or --as-job), shared so the
-    # two dispatch paths can never drift on precedence or thinking-level translation.
+    # Resolve harness/model/effort for a dispatch, so every dispatch path reads
+    # precedence and thinking-level translation from one place.
     def resolve_dispatch_harness(lane_entry, model:, harness:, effort:, force:, err:)
       model, suffix_level = Harness.parse_model_suffix(model)
       resolved_harness, resolved_model = resolve_harness_model(harness, model,
@@ -1737,69 +1657,9 @@ module Space::Architect
       [resolved_harness, resolved_model, resolved_effort]
     end
 
-    # #89/AC1-AC5: resolve the claude-code --allowedTools grant for a dispatch (local or
-    # --as-job), shared so both paths resolve precedence identically. The CLI flag beats
-    # the lane's recorded allowed_tools:/append_allowed_tools: (frozen-declaration or a
-    # prior dispatch's stamp) — resolved independently for replace vs. append, so a flag
-    # on one axis and a lane value on the other both apply (Objective A). Meaningless for
-    # opencode/pi (no equivalent grant mechanism) — still resolved/recorded for visibility,
-    # but Harness.for only wires it into the claude-code branch's argv.
-    def resolve_allowed_tools(lane_entry, allowed_tools:, append_allowed_tools:)
-      replace, replace_from =
-        if allowed_tools
-          [allowed_tools, "--allowed-tools flag"]
-        elsif lane_entry["allowed_tools"]
-          [lane_entry["allowed_tools"], "lane's allowed_tools:"]
-        else
-          [nil, "default"]
-        end
-
-      append, append_from =
-        if append_allowed_tools
-          [append_allowed_tools, "--append-allowed-tools flag"]
-        elsif lane_entry["append_allowed_tools"]
-          [lane_entry["append_allowed_tools"], "lane's append_allowed_tools:"]
-        end
-
-      final = Harness::ClaudeCodeHarness.resolve_tools(replace: replace, append: append)
-      provenance = "allowed-tools: #{replace_from}#{append_from ? " + #{append_from}" : ""} → #{final}"
-      [final, replace, append, provenance]
-    end
-
-    # Compose a dispatch --as-job spec per the space-server's job contract: prompt +
-    # workspace.dir (the lane worktree) + environment (deps/network/mounts/env or
-    # secrets) + harness (claude/backend/args) + provenance. mounts are src:dst with
-    # src == dst — the sandboxed executor requires the lane worktree AND the repo
-    # checkout mounted at their identical host absolute paths for the worktree's
-    # gitdir pointer to resolve.
-    def job_spec(iteration:, lane:, wt_path:, build_dir:, repo_path:, prompt_content:, backend_url:,
-                job_model:, api_key_ref:, harness_args:)
-      harness = { "type" => "claude", "backend" => { "base_url" => backend_url }, "args" => harness_args }
-      harness["model"] = job_model if job_model
-      harness["backend"]["api_key_ref"] = api_key_ref if api_key_ref
-
-      environment = {
-        "env"  => api_key_ref ? {} : { "ANTHROPIC_API_KEY" => "unused-for-keyless-backends" },
-        "deps" => ["git"],
-        "permissions" => {
-          "network" => true,
-          "mounts"  => ["#{build_dir}:#{build_dir}", "#{repo_path}:#{repo_path}"]
-        }
-      }
-      environment["secrets"] = [{ "ref" => api_key_ref, "name" => "ANTHROPIC_API_KEY" }] if api_key_ref
-
-      {
-        "prompt"      => prompt_content,
-        "workspace"   => { "dir" => wt_path.to_s },
-        "environment" => environment,
-        "harness"     => harness,
-        "provenance"  => { "space" => Space::Core::Slugger.slug(space.title), "iteration" => iteration, "lane" => lane }
-      }
-    end
-
     def recorded_lane_fields(lane_entry)
       {
-        harness: lane_entry["harness"] || "claude-code",
+        harness: lane_entry["harness"] || "pi",
         model:   lane_entry["model"],
         variant: lane_entry["variant"] || false,
         effort:  lane_entry["effort"]

data/lib/space_architect/cli/architect.rb

@@ -178,18 +178,10 @@ module Space::Architect
                   nn = s["ordinal"] ? format("%02d", s["ordinal"]) : "-"
                   lane_list = s["lanes"] || []
                   lanes_str = lane_list.map do |l|
-                    h = l["harness"] || "claude-code"
-                    m = l["model"]   || Harness.default_model_for(h)
+                    h = l["harness"] || "pi"
+                    m = l["model"]   || Harness::DEFAULT_MODEL
                     eff = l["effort"] ? "·#{l['effort']}" : ""
-                    # #89/AC8: the resolved tool grant, visible next to the other resolved
-                    # values — only when it diverges from the harness default, to keep the
-                    # common case (no lane touches it) uncluttered. Meaningless outside
-                    # claude-code (no equivalent grant mechanism), so shown only there.
-                    tools = if h == "claude-code"
-                      resolved = Harness::ClaudeCodeHarness.resolve_tools(replace: l["allowed_tools"], append: l["append_allowed_tools"])
-                      resolved == Harness::ClaudeCodeHarness::ALLOWED_TOOLS ? "" : "·tools:#{resolved}"
-                    end
-                    "#{l['name']}(#{l['repo']}·#{h}·#{m}#{eff}#{tools})"
+                    "#{l['name']}(#{l['repo']}·#{h}·#{m}#{eff})"
                   end.join(", ")
                   lanes = lane_list.any? { |l| l["variant"] } ? "variant: #{lanes_str}" : lanes_str
                   lanes = "#{lanes} → winner: #{s['winner']}" if s["winner"]
@@ -493,107 +485,68 @@ module Space::Architect
         argument :lane,      required: true,  desc: "Lane name"
         argument :space,     required: false, desc: "Space identifier (default: $PWD)"
         option   :prompt,    default: nil,    desc: "Read the lane prompt from this file (copied byte-for-byte to build/<id>-<lane>/prompt.md)"
-        option   :model,     default: nil,    desc: "Builder model to pin (default: the lane's stored model, else space.yaml project.model, else the per-harness sensible default). Any provider/tier; pin a full id, not a floating alias"
+        option   :model,     default: nil,    desc: "Builder model to pin (default: the lane's stored model, else space.yaml project.model, else the pi default #{Harness::DEFAULT_MODEL}). Any provider/tier; pin a full id, not a floating alias"
         option   :max_turns, default: "200",  desc: "Max turns for the builder"
-        option   :harness,   default: nil,    desc: "Harness override (claude-code, opencode, pi)"
-        option   :allowed_tools,        default: nil, desc: "Comma-separated tool list — replaces the claude-code --allowedTools grant for this dispatch (default: Read,Edit,Write,Grep,Glob,Bash,WebSearch,WebFetch). The lane's frozen allowed_tools: does the same with no flag; this flag wins over that key. Meaningless for opencode/pi"
-        option   :append_allowed_tools, default: nil, desc: "Comma-separated tool list — appends to the claude-code --allowedTools grant for this dispatch (to the flag/lane replace value, or the default). The lane's frozen append_allowed_tools: does the same with no flag; this flag wins over that key. Meaningless for opencode/pi"
-        option   :effort,    default: nil,    desc: "Thinking/reasoning effort level — alias for --thinking/--reasoning (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness"
-        option   :thinking,  default: nil,    desc: "Thinking/reasoning effort level — alias for --effort/--reasoning (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness"
-        option   :reasoning, default: nil,    desc: "Thinking/reasoning effort level — alias for --effort/--thinking (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness"
-        option   :force_effort,    default: nil, desc: "Force the literal level onto the harness flag, skipping architect's clamp — alias for --force-thinking/--force-reasoning (dispatch only; the binary's rejection is final)"
-        option   :force_thinking,  default: nil, desc: "Force the literal level onto the harness flag, skipping architect's clamp — alias for --force-effort/--force-reasoning (dispatch only; the binary's rejection is final)"
-        option   :force_reasoning, default: nil, desc: "Force the literal level onto the harness flag, skipping architect's clamp — alias for --force-effort/--force-thinking (dispatch only; the binary's rejection is final)"
+        option   :harness,   default: nil,    desc: "Harness (pi)"
+        option   :effort,    default: nil,    desc: "Thinking/reasoning effort level — alias for --thinking/--reasoning (off, minimal, low, medium, high, xhigh, max)"
+        option   :thinking,  default: nil,    desc: "Thinking/reasoning effort level — alias for --effort/--reasoning (off, minimal, low, medium, high, xhigh, max)"
+        option   :reasoning, default: nil,    desc: "Thinking/reasoning effort level — alias for --effort/--thinking (off, minimal, low, medium, high, xhigh, max)"
+        option   :force_effort,    default: nil, desc: "Force the literal level onto the --thinking flag, skipping architect's validation — alias for --force-thinking/--force-reasoning (dispatch only; the binary's rejection is final)"
+        option   :force_thinking,  default: nil, desc: "Force the literal level onto the --thinking flag, skipping architect's validation — alias for --force-effort/--force-reasoning (dispatch only; the binary's rejection is final)"
+        option   :force_reasoning, default: nil, desc: "Force the literal level onto the --thinking flag, skipping architect's validation — alias for --force-effort/--force-thinking (dispatch only; the binary's rejection is final)"
         option   :quiet,    type: :boolean, default: false, desc: "Suppress thinking-translation and harness run-time warn lines (liveness/push) on $stderr for this dispatch"
         option   :detach,    type: :boolean, default: false, desc: "Detach the builder process (returns immediately with PID; poll report for completion)"
         option   :timeout,   default: "14400", desc: "Wall-clock timeout in seconds (0 disables; default 4h); foreground only"
         option   :push_url,   default: nil,   desc: "HTTP endpoint for streaming push (POST body to this URL)"
         option   :push_token, default: nil,   desc: "Bearer token for push endpoint authorization"
         option   :push_host,  default: nil,   desc: "Base URL of the ingest server; the CLI creates a run via POST <host>/runs and streams to /runs/<id>/ingest (requires --push-token)"
-        option   :as_job,     type: :boolean, default: false, desc: "Submit the run as a job to the space-server's queue instead of running locally (sandboxed executor; requires --host/--token/--backend-url)"
-        option   :host,        default: nil, desc: "Base URL of the space-server (required with --as-job)"
-        option   :token,       default: nil, desc: "Bearer token for authorization (required with --as-job)"
-        option   :backend_url, default: nil, desc: "Base URL of the harness backend the sandboxed job talks to (required with --as-job)"
-        option   :job_model,   default: nil, desc: "Model pinned for the sandboxed job's harness — distinct from --model, which is meaningless against a non-Anthropic backend"
-        option   :api_key_ref, default: nil, desc: "op:// reference resolved into ANTHROPIC_API_KEY server-side (--as-job only; omit for keyless backends)"
 
         def call(iteration:, lane:, space: nil, prompt: nil, model: nil,
                  max_turns: "200", harness: nil, effort: nil, thinking: nil, reasoning: nil,
-                 allowed_tools: nil, append_allowed_tools: nil,
                  force_effort: nil, force_thinking: nil, force_reasoning: nil, quiet: false, detach: false,
-                 timeout: "14400", push_url: nil, push_token: nil, push_host: nil,
-                 as_job: false, host: nil, token: nil, backend_url: nil, job_model: nil, api_key_ref: nil, **opts)
+                 timeout: "14400", push_url: nil, push_token: nil, push_host: nil, **opts)
           setup_terminal(**opts.slice(:color, :colors))
           handle_errors do
             level = resolve_thinking_alias(effort: effort, thinking: thinking, reasoning: reasoning)
             forced_level = resolve_force_thinking_alias(force_effort: force_effort,
               force_thinking: force_thinking, force_reasoning: force_reasoning)
 
-            if as_job
-              Jobs.require_credentials!(host, token)
-              raise Space::Core::Error, "--backend-url is required with --as-job" unless backend_url
-              raise Space::Core::Error, "--job-model is required with --as-job" unless job_model
-              raise Space::Core::Error, "--as-job cannot be combined with --push-url/--push-token/--push-host/--detach" \
-                if push_url || push_token || push_host || detach
-            end
-
             render(store.find(space)) do |sp|
               project = ArchitectProject.new(space: sp)
 
-              if as_job
-                kwargs = { host: host, token: token, backend_url: backend_url, max_turns: max_turns.to_i }
-                kwargs[:prompt]      = prompt          if prompt
-                kwargs[:model]       = model           if model
-                kwargs[:harness]     = harness         if harness
-                kwargs[:effort]      = forced_level || level if forced_level || level
-                kwargs[:allowed_tools]        = allowed_tools        if allowed_tools
-                kwargs[:append_allowed_tools] = append_allowed_tools if append_allowed_tools
-                kwargs[:force]       = true            if forced_level
-                kwargs[:quiet]       = true             if quiet
-                kwargs[:job_model]   = job_model       if job_model
-                kwargs[:api_key_ref] = api_key_ref     if api_key_ref
-                res = project.dispatch_as_job(iteration, lane, **kwargs)
-                terminal.say "Prompt:  #{prompt} → #{terminal.path(res[:prompt_copied])}" if res[:prompt_copied]
-                terminal.say "Job:     #{res[:job_id]}"
-                terminal.say "Watch:   architect jobs watch #{res[:job_id]} --host #{host} --token #{token}"
+              kwargs = { max_turns: max_turns.to_i, detach: detach }
+              kwargs[:prompt]     = prompt          if prompt
+              kwargs[:model]      = model           if model
+              kwargs[:harness]    = harness         if harness
+              kwargs[:effort]     = forced_level || level if forced_level || level
+              kwargs[:force]      = true            if forced_level
+              kwargs[:quiet]      = true             if quiet
+              kwargs[:timeout]    = timeout.to_i    unless detach
+              kwargs[:push_url]   = push_url        if push_url
+              kwargs[:push_token] = push_token      if push_token
+              kwargs[:push_host]  = push_host       if push_host
+              res = project.dispatch(iteration, lane, **kwargs)
+              terminal.say "Prompt:  #{prompt} → #{terminal.path(res[:prompt_copied])}" if res[:prompt_copied]
+              if detach
+                terminal.say "PID:     #{res[:pid]}"
+                terminal.say "Run log: #{terminal.path(res[:run_log])}"
+                terminal.say "Report:  #{terminal.path(res[:report])}"
+                terminal.say "Dispatched detached — poll #{terminal.path(res[:report])} for completion"
                 CLI.record_outcome(Outcome.new(exit_code: 0))
+              elsif res[:timed_out]
+                terminal.say "Run log: #{terminal.path(res[:run_log])}"
+                terminal.say "Report:  #{terminal.path(res[:report])}"
+                terminal.say "Builder TIMED OUT after #{timeout}s — process group killed. Re-dispatch (lanes are cheap)."
+                CLI.record_outcome(Outcome.new(exit_code: res[:exit_code]))
               else
-                kwargs = { max_turns: max_turns.to_i, detach: detach }
-                kwargs[:prompt]     = prompt          if prompt
-                kwargs[:model]      = model           if model
-                kwargs[:harness]    = harness         if harness
-                kwargs[:effort]     = forced_level || level if forced_level || level
-                kwargs[:allowed_tools]        = allowed_tools        if allowed_tools
-                kwargs[:append_allowed_tools] = append_allowed_tools if append_allowed_tools
-                kwargs[:force]      = true            if forced_level
-                kwargs[:quiet]      = true             if quiet
-                kwargs[:timeout]    = timeout.to_i    unless detach
-                kwargs[:push_url]   = push_url        if push_url
-                kwargs[:push_token] = push_token      if push_token
-                kwargs[:push_host]  = push_host       if push_host
-                res = project.dispatch(iteration, lane, **kwargs)
-                terminal.say "Prompt:  #{prompt} → #{terminal.path(res[:prompt_copied])}" if res[:prompt_copied]
-                if detach
-                  terminal.say "PID:     #{res[:pid]}"
-                  terminal.say "Run log: #{terminal.path(res[:run_log])}"
-                  terminal.say "Report:  #{terminal.path(res[:report])}"
-                  terminal.say "Dispatched detached — poll #{terminal.path(res[:report])} for completion"
-                  CLI.record_outcome(Outcome.new(exit_code: 0))
-                elsif res[:timed_out]
-                  terminal.say "Run log: #{terminal.path(res[:run_log])}"
-                  terminal.say "Report:  #{terminal.path(res[:report])}"
-                  terminal.say "Builder TIMED OUT after #{timeout}s — process group killed. Re-dispatch (lanes are cheap)."
-                  CLI.record_outcome(Outcome.new(exit_code: res[:exit_code]))
-                else
-                  terminal.say "Run log: #{terminal.path(res[:run_log])}"
-                  terminal.say "Report:  #{terminal.path(res[:report])}"
-                  terminal.say "Ingest URL:  #{res[:push_url]}" if res[:push_url]
-                  terminal.say "Builder exited with status #{res[:exit_code]}"
-                  unless res[:report].exist? && !res[:report].read.strip.empty?
-                    terminal.say "WARNING: no report at #{terminal.path(res[:report])} — the lane produced no deliverable."
-                  end
-                  CLI.record_outcome(Outcome.new(exit_code: res[:exit_code]))
+                terminal.say "Run log: #{terminal.path(res[:run_log])}"
+                terminal.say "Report:  #{terminal.path(res[:report])}"
+                terminal.say "Ingest URL:  #{res[:push_url]}" if res[:push_url]
+                terminal.say "Builder exited with status #{res[:exit_code]}"
+                unless res[:report].exist? && !res[:report].read.strip.empty?
+                  terminal.say "WARNING: no report at #{terminal.path(res[:report])} — the lane produced no deliverable."
                 end
+                CLI.record_outcome(Outcome.new(exit_code: res[:exit_code]))
               end
             end
           end
@@ -858,7 +811,7 @@ module Space::Architect
       class InstallSkills < BaseCommand
         desc "Install bundled skills (architect, architect-research, architect-vocabulary) for a harness"
         phase 53, "Project"
-        option :provider, default: "claude", desc: "Harness: claude, codex, opencode, pi"
+        option :provider, default: "claude", desc: "Skill install target (default: claude; validated by the installer)"
         option :project, type: :boolean, default: false, desc: "Install to CWD instead of global"
         option :force,   type: :boolean, default: false, desc: "Overwrite existing skills that differ"
         option :dry_run, type: :boolean, default: false, desc: "Print what would happen without writing files"
@@ -886,11 +839,11 @@ module Space::Architect
           argument :lane,      required: true, desc: "Lane name"
           argument :space,     required: false, desc: "Space identifier (default: $PWD)"
           option   :base,      default: nil,          desc: "Base ref (default: HEAD of repo)"
-          option   :harness,   default: nil,          desc: "Harness (claude-code, opencode, pi; default: space.yaml project.harness, else claude-code)"
-          option   :model,     default: nil,           desc: "Model; a trailing :<level> suffix (e.g. foo:high) is parsed into --effort (default: space.yaml project.model, else the per-harness sensible default)"
-          option   :effort,    default: nil,           desc: "Thinking/reasoning effort level — alias for --thinking/--reasoning (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness at dispatch time"
-          option   :thinking,  default: nil,           desc: "Thinking/reasoning effort level — alias for --effort/--reasoning (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness at dispatch time"
-          option   :reasoning, default: nil,           desc: "Thinking/reasoning effort level — alias for --effort/--thinking (off, minimal, low, medium, high, xhigh, max); translated + clamped to the lane's harness at dispatch time"
+          option   :harness,   default: nil,          desc: "Harness (pi; default: space.yaml project.harness, else pi)"
+          option   :model,     default: nil,           desc: "Model; a trailing :<level> suffix (e.g. foo:high) is parsed into --effort (default: space.yaml project.model, else the pi default #{Harness::DEFAULT_MODEL})"
+          option   :effort,    default: nil,           desc: "Thinking/reasoning effort level — alias for --thinking/--reasoning (off, minimal, low, medium, high, xhigh, max)"
+          option   :thinking,  default: nil,           desc: "Thinking/reasoning effort level — alias for --effort/--reasoning (off, minimal, low, medium, high, xhigh, max)"
+          option   :reasoning, default: nil,           desc: "Thinking/reasoning effort level — alias for --effort/--thinking (off, minimal, low, medium, high, xhigh, max)"
           option   :quiet,     type: :boolean, default: false, desc: "Suppress the thinking-translation inform line on $stderr"
           option   :touch,     default: nil,           desc: "Comma-separated file globs the lane may touch (records its touch_set for in-bounds + merge checks)"
           option   :force,     type: :boolean, default: false, desc: "Clear and re-create a stale (unregistered) worktree directory"
@@ -970,7 +923,7 @@ module Space::Architect
           argument :repo,      required: true,  desc: "Repo name (under repos/)"
           argument :iteration, required: true,  desc: "Iteration name"
           argument :space,     required: false, desc: "Space identifier (default: $PWD)"
-          option   :pairs,     required: true,  desc: "Comma-separated harness[:model] pairs (e.g. claude-code,opencode:fireworks-ai/accounts/fireworks/models/glm-5p2)"
+          option   :pairs,     required: true,  desc: "Comma-separated harness[:model] pairs (e.g. pi,pi:#{Harness::DEFAULT_MODEL})"
           option   :base,      default: nil,    desc: "Base ref (default: HEAD of repo)"
           option   :prompt,    default: nil,    desc: "Prompt file to fan-out byte-identical to each variant"