@aeondave/pi-persona 1.17.1 → 1.17.3

package/src/ui/session-cards.ts

@@ -0,0 +1,189 @@
+/** Operator-only presentation of existing session payloads. No delivery, storage or tool shells. */
+import type { ExtensionAPI, Theme, ThemeBg, ThemeColor } from "@earendil-works/pi-coding-agent";
+import { Text, truncateToWidth, type Component } from "@earendil-works/pi-tui";
+import { formatDuration } from "../core/time.ts";
+import { neutralizeMonitorUnicode } from "../core/monitor-output.ts";
+import { createReportBody } from "./report-body.ts";
+import { MONITOR_LOG_ENTRY, parseMonitorLogRecord, type MonitorLogRecord } from "../monitor/archive.ts";
+import { summarizeFailure } from "./failure-summary.ts";
+import { compactInlineText, compactVisibleText, sanitizeTerminalText, type CompactVisibleTextResult } from "./presentation.ts";
+
+type State = "neutral" | "success" | "attention" | "error";
+const COLORS: Record<State, { bg: ThemeBg; fg: ThemeColor }> = {
+	neutral: { bg: "customMessageBg", fg: "accent" },
+	success: { bg: "toolSuccessBg", fg: "success" },
+	attention: { bg: "toolPendingBg", fg: "warning" },
+	error: { bg: "toolErrorBg", fg: "error" },
+};
+interface Card {
+	title: string;
+	state: State;
+	full: string;
+	preview: (width: number) => Pick<CompactVisibleTextResult, "text" | "truncated">;
+	metadata?: string;
+	/** Selected only by trusted surface/envelope metadata, never prose keywords. */
+	markdown?: boolean;
+}
+
+/** All seven surfaces share semantic chrome. Literal paths style at paint time; report bodies
+ * use native Markdown's invalidatable layout cache. Pi rebuilds callbacks on transcript invalidation. */
+function createSessionCard(card: Card, expanded: boolean, theme: Theme, detailHint: () => string, outputPad = 0): Component {
+	if (expanded && card.markdown) {
+		return createReportBody(card.full || "(no output)", theme, {
+			padding: outputPad,
+			background: COLORS[card.state].bg,
+			header: (width) => [
+				theme.fg(COLORS[card.state].fg, theme.bold(truncateToWidth(sanitizeTerminalText(card.title), width))),
+				...(card.metadata ? [theme.fg("dim", truncateToWidth(card.metadata, width))] : []),
+			].join("\n"),
+		});
+	}
+	return {
+		invalidate() { /* Literal Text path has no themed/layout cache. */ },
+		render(width) {
+			if (width <= 0) return [];
+			const padding = Math.min(Math.max(0, Math.floor(outputPad)), Math.max(0, Math.floor((width - 1) / 2)));
+			const innerWidth = Math.max(1, width - padding * 2);
+			const colors = COLORS[card.state];
+			const preview = expanded ? undefined : card.preview(innerWidth);
+			const body = expanded ? card.full : preview?.text ?? "(no output)";
+			const lines = [
+				theme.fg(colors.fg, theme.bold(truncateToWidth(sanitizeTerminalText(card.title), innerWidth))),
+				...(card.metadata ? [theme.fg("dim", truncateToWidth(card.metadata, innerWidth))] : []),
+				...sanitizeTerminalText(body || "(no output)").split("\n").map((line) => theme.fg("toolOutput", line)),
+				...(preview?.truncated ? [theme.fg("dim", truncateToWidth(detailHint(), innerWidth))] : []),
+			];
+			// Text owns wrapping and full-row padding/background, including embedded foreground resets.
+			// A terminal narrower than a single wide glyph cannot display that glyph; clip only there.
+			return new Text(lines.join("\n"), padding, 0, (text) => theme.bg(colors.bg, text))
+				.render(width).map((line) => truncateToWidth(line, width));
+		},
+	};
+}
+
+function preview(full: string, maxLines: number, maxColumns: number): Card["preview"] {
+	return (width) => compactVisibleText(full, { maxLines, maxLineChars: Math.min(width, maxColumns) });
+}
+
+/** Only this exact runtime-owned aggregate is evidence of settlement. No keyword scan of output,
+ * asks, timers, monitor event bodies, or peers. Legacy/unknown follow-ups remain informational. */
+function followUpState(full: string): { state: State; status: string } {
+	const first = full.split("\n", 1)[0] ?? "";
+	const summary = /^(?:\[pi-persona\] )?(\d+) async runs? settled — (\d+) done, (\d+) failed(?:, (\d+) stopped)?$/.exec(first);
+	if (summary) {
+		const total = Number(summary[1]);
+		const done = Number(summary[2]);
+		const failed = Number(summary[3]);
+		const stopped = Number(summary[4] ?? 0);
+		if ([total, done, failed, stopped].every(Number.isSafeInteger) && total > 0 && total === done + failed + stopped) {
+			if (failed > 0) return { state: "error", status: "failed" };
+			if (stopped > 0) return { state: "attention", status: "stopped" };
+			return { state: "success", status: "complete" };
+		}
+	}
+	return { state: "neutral", status: "info" };
+}
+
+function monitorState(record: MonitorLogRecord): { state: State; status: string } {
+	if (record.outcome === "error") return { state: "error", status: "failed" };
+	if (record.outcome === "timeout" || record.outcome === "cancelled") return { state: "attention", status: "stopped" };
+	if (record.outcome === "exit") {
+		// MonitorManager prepends this line before any untrusted stdout/stderr diagnostics.
+		const first = record.text.split("\n", 1)[0] ?? "";
+		const exit = /^process exited with exit code (-?\d+)$/.exec(first);
+		if (exit) return exit[1] === "0" ? { state: "success", status: "complete" } : { state: "error", status: "failed" };
+		if (/^process exited (?:by .+|with exit code -?\d+ \(signal .+\))$/.test(first)) return { state: "attention", status: "stopped" };
+	}
+	return { state: "neutral", status: "info" };
+}
+
+interface ResultEntry { label?: string; content?: string; ok?: boolean; stoppedAtGate?: string; failureKind?: string; error?: string }
+interface ContentEntry { content?: string; kind?: "routine" | "stall" }
+interface RunFailureEntry { id: string; label: string; agent: string; model?: string; durationMs?: number; error: string }
+
+export interface SessionCardOptions {
+	detailHint: () => string;
+	/** Existing bounded/fenced runtime formatter, injected to keep UI independent of tool wiring. */
+	monitorLog: (record: MonitorLogRecord) => string;
+}
+
+export function registerSessionCards(pi: Pick<ExtensionAPI, "registerMessageRenderer" | "registerEntryRenderer">, options: SessionCardOptions): void {
+	const sessionCard = (card: Card, expanded: boolean, theme: Theme, outputPad = 0): Component =>
+		createSessionCard(card, expanded, theme, options.detailHint, outputPad);
+	for (const customType of ["pi-persona", "exocom_received"] as const) {
+		pi.registerMessageRenderer(customType, (message, { expanded, outputPad }, theme) => {
+			const raw = typeof message.content === "string" ? message.content
+				: message.content.map((part) => part.type === "text" ? part.text : "[image]").join("\n");
+			const full = sanitizeTerminalText(raw);
+			const { state, status } = customType === "pi-persona" ? followUpState(full) : { state: "neutral" as const, status: "inbound" };
+			// Only the validated settlement envelope is a pi-persona report. Unknown is NOT
+			// Markdown: monitor stdout/stderr, timers and operational notices share this type.
+			const markdown = customType === "exocom_received" || status !== "info";
+			return sessionCard({ title: customType === "pi-persona" ? `pi-persona · update · ${status}` : "exocom · inbound", state, full, markdown, preview: preview(full, 4, 100) }, expanded, theme, outputPad);
+		});
+	}
+	pi.registerEntryRenderer(MONITOR_LOG_ENTRY, (entry, { expanded }, theme) => {
+		const record = parseMonitorLogRecord(entry.data);
+		if (!record) return undefined;
+		const { state, status } = monitorState(record);
+		return sessionCard({
+			title: `Monitor log ${compactInlineText(record.entry.label)} · ${record.outcome} · ${status}`,
+			state, full: sanitizeTerminalText(options.monitorLog(record)),
+			preview: (width) => ({ text: `${compactInlineText(neutralizeMonitorUnicode(record.text), { maxChars: Math.min(width, 160) })}\n${compactInlineText(record.entry.id)} · monitor result`, truncated: true }),
+		}, expanded, theme);
+	});
+	pi.registerEntryRenderer<RunFailureEntry>("pi-persona-run-failure", (entry, { expanded }, theme) => {
+		const data = entry.data;
+		if (!data) return undefined;
+		const metadata = [compactInlineText(data.agent, { maxChars: 48 }), ...(data.model ? [compactInlineText(data.model, { maxChars: 96 })] : []), ...(data.durationMs !== undefined ? [formatDuration(data.durationMs)] : [])].join(" · ");
+		return sessionCard({
+			title: `${compactInlineText(data.label || data.agent, { maxChars: 80 })} · failed`, state: "error", metadata,
+			full: `Run ${compactInlineText(data.id)}\n${sanitizeTerminalText(data.error)}`,
+			preview: (width) => ({ text: compactVisibleText(summarizeFailure(data.error), { maxLines: 2, maxLineChars: Math.min(width, 100) }).text, truncated: true }),
+		}, expanded, theme);
+	});
+	pi.registerEntryRenderer<ResultEntry>("pi-persona-result", (entry, { expanded }, theme) => {
+		const data = entry.data;
+		if (!data) return undefined;
+		const full = sanitizeTerminalText(data.content || "(no output)");
+		const stopped = data.ok !== true && typeof data.stoppedAtGate === "string";
+		const state: State = stopped ? "attention" : data.ok === true ? "success" : data.ok === false ? "error" : "neutral";
+		const status = stopped ? `stopped · checkpoint ${compactInlineText(data.stoppedAtGate ?? "", { maxChars: 32 })}` : data.ok === true ? "complete" : data.ok === false ? "failed" : "unknown";
+		const cause = compactVisibleText([data.failureKind, data.error].filter(Boolean).join(" · "), { maxLines: 1, maxLineChars: 80 }).text;
+		return sessionCard({
+			title: `${compactInlineText(data.label ?? "", { maxChars: 96 }) || "result"} · ${status}${state === "error" && cause !== "(no output)" ? ` · ${cause}` : ""}`,
+			state, full, markdown: true, preview: preview(full, 3, 100),
+		}, expanded, theme);
+	});
+	pi.registerEntryRenderer<ContentEntry>("pi-persona-nudge", (entry, { expanded }, theme) => {
+		if (!entry.data) return undefined;
+		const full = sanitizeTerminalText(entry.data.content || "⟢ pi-persona · checkpoint");
+		const lines = full.split("\n").map((line) => line.trim()).filter(Boolean);
+		const header = compactInlineText(lines[0]?.replace(/^⟢\s*/, "") ?? "", { maxChars: 96 }) || "pi-persona · checkpoint";
+		const details = lines.slice(1);
+		const trigger = details.find((line) => line.startsWith("Trigger:"));
+		const action = details.find((line) => /^(?:Action|Verify|Otherwise):/.test(line));
+		const selected = [trigger, action].filter((line): line is string => line !== undefined);
+		const chosen = selected.length > 0 ? selected : details.slice(0, 2);
+		return sessionCard({
+			title: header, state: "attention", full,
+			preview: (width) => {
+				const result = preview(chosen.join("\n"), 2, 100)(width);
+				return { text: result.text, truncated: result.truncated || details.some((line) => !chosen.includes(line)) };
+			},
+		}, expanded, theme);
+	});
+	pi.registerEntryRenderer<ContentEntry>("pi-persona-status", (entry, { expanded }, theme) => {
+		if (!entry.data) return undefined;
+		const full = sanitizeTerminalText(entry.data.content || "Async activity · routine check-in");
+		const stall = entry.data.kind === "stall";
+		const digest = full.split("\n").slice(1).filter((line) => line.trim().length > 0);
+		return sessionCard({
+			title: stall ? "pi-persona · possible stall" : "pi-persona · async status", state: stall ? "attention" : "neutral", full,
+			preview: (width) => {
+				const result = preview(digest.slice(0, 2).join("\n") || full, 2, 140)(width);
+				return { text: result.text, truncated: result.truncated || digest.length > 2 };
+			},
+		}, expanded, theme);
+	});
+}

package/src/ui/wake-rows.ts

@@ -0,0 +1,262 @@
+import { stripTerminalControls } from "../core/fence.ts";
+import type { MonitorEntry, MonitorEvent, MonitorOutput } from "../core/monitor.ts";
+import { MonitorOutputTail } from "../core/monitor-output.ts";
+import type { TimerEntry } from "../core/timer.ts";
+import type { AddNodeInput, AgentNodePatch, AgentNodeStatus } from "./agent-tree.ts";
+
+/**
+ * Wake-source rows — the pure mapping from monitor/timer lifecycle callbacks to agent-tree rows.
+ *
+ * Monitors and timers are background wake sources, not agents, but the operator should see them
+ * beside the sub-agents: what is armed, when it is due, what it has produced, why it ended. This
+ * module turns each lifecycle callback into an `AddNodeInput` / `AgentNodePatch` and nothing more:
+ * no tree, no clock, no Pi imports. Every timestamp comes from the entry or event itself, so the
+ * output is deterministic. Monitor labels, details and metadata are sanitized and bounded;
+ * live output adds a single-line progress preview without becoming a semantic event. Anything
+ * long — command, timer message, event history and bounded stdout/stderr tails — lives in
+ * `output`, which only the F9 drill-in shows.
+ */
+
+/** Longest `command: …` description line (args may total 24k chars). */
+const COMMAND_LINE_MAX = 2_000;
+/** Longest first-line excerpt of one monitor event kept in the drill-in. */
+const EVENT_TEXT_MAX = 1_000;
+/** Longest first-line summary of a non-output terminal event, used as the row detail. */
+const SUMMARY_MAX = 120;
+/** Longest timer label shown on a row (the scheduler bounds it too; this projection does not trust that). */
+const TIMER_LABEL_MAX = 120;
+/** Event lines the drill-in remembers per monitor; older ones fall off the front. */
+const MAX_EVENT_LINES = 40;
+/** The manager's status line for a clean exit; diagnostics (stdout/stderr tails) follow on later lines. */
+const CLEAN_EXIT = /\bexit code 0\b/;
+
+/** Tree id of a wake-source row: `monitor:<id>` / `timer:<id>` (never collides with `async:`/strategy ids). */
+export function wakeNodeId(kind: "monitor" | "timer", id: string): string {
+	return `${kind}:${id}`;
+}
+
+export interface WakeRowChange {
+	id: string;
+	patch: AgentNodePatch;
+}
+
+export interface WakeRowEvent extends WakeRowChange {
+	/** true when this event ended the watch (the row must settle and leave). */
+	settled: boolean;
+}
+
+/** ISO-8601 for a display line; "?" for a non-finite or out-of-range instant instead of throwing. */
+function iso(ms: number): string {
+	if (!Number.isFinite(ms)) return "?";
+	const date = new Date(ms);
+	return Number.isFinite(date.getTime()) ? date.toISOString() : "?";
+}
+
+/** At most `max` code units, ending in "…" when clipped; never cuts an astral character in half. */
+function clamp(text: string, max: number): string {
+	if (text.length <= max) return text;
+	let end = max - 1;
+	const last = text.charCodeAt(end - 1);
+	if (last >= 0xd800 && last <= 0xdbff) end -= 1;
+	return `${text.slice(0, end)}…`;
+}
+
+function firstLine(text: string): string {
+	const newline = text.indexOf("\n");
+	const line = newline < 0 ? text : text.slice(0, newline);
+	return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+
+/**
+ * One self-contained display line: terminal controls stripped, any line break that survives
+ * (`stripTerminalControls` maps a bare `\r` to `\n`) collapsed to a single visible marker.
+ *
+ * Done per stored line, NOT at render time, on purpose. `renderMonitorOutput` joins every stored line
+ * into one buffer and the F9 overlay sanitises only that joined buffer, after the join. A child
+ * line carrying a bare `\r` would then render as two lines, the second able to pose as a genuine
+ * `[<iso>] …` event line (a forged event), and an unterminated escape in one line could swallow the
+ * genuine lines after it. Each line must already be inert before it is joined with its neighbours.
+ */
+function oneLine(text: string): string {
+	return stripTerminalControls(text).replace(/[\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "").replace(/[\n\u2028\u2029]+/g, " ⏎ ").replace(/\t/g, " ").trim();
+}
+
+/** What a monitor remembers between its arming and its end. */
+interface MonitorState {
+	displayId: string;
+	mode: MonitorEntry["mode"];
+	stdout: MonitorOutputTail;
+	stderr: MonitorOutputTail;
+	preview: string;
+	latestStream: MonitorOutput["stream"];
+	/** One dirty bit per admitted monitor, never a queue of raw chunks. */
+	outputPending: boolean;
+	/** Description lines above the events counter (mode, command, cwd, timing). */
+	base: string[];
+	maxEvents: number;
+	/** Whether the description carries an `events:` counter line (output mode). */
+	counted: boolean;
+	/** Output events seen so far. */
+	events: number;
+	/** The last `MAX_EVENT_LINES` event lines, oldest first. */
+	lines: string[];
+}
+
+function renderMonitorOutput(state: MonitorState): string {
+	const counter = state.counted || state.events > 0 ? [`events: ${state.events}/${state.maxEvents}`] : [];
+	const tails: string[] = [];
+	for (const stream of ["stdout", "stderr"] as const) {
+		const text = state[stream].text.trimEnd();
+		// Quote every untrusted line: output must not impersonate the metadata or event history.
+		if (text) tails.push(`${stream} tail:\n> ${text.replace(/\n/g, "\n> ")}`);
+	}
+	return [...state.base, ...counter, ...state.lines, ...tails].join("\n");
+}
+
+/** Preview construction, like the drill-in, belongs to publication rather than raw ingestion. */
+function refreshMonitorPreview(state: MonitorState): void {
+	if (!state.outputPending) return;
+	const other = state.latestStream === "stdout" ? "stderr" : "stdout";
+	for (const stream of [state.latestStream, other] as const) {
+		const preview = clamp(state[stream].preview, SUMMARY_MAX);
+		if (preview) {
+			state.preview = `${stream}: ${preview}`;
+			break;
+		}
+	}
+	state.outputPending = false;
+}
+
+function monitorDetail(state: MonitorState): string {
+	const counter = state.counted || state.events > 0 ? ` · ${state.events}/${state.maxEvents} events` : "";
+	return `${state.displayId} · ${state.mode}${counter}${state.preview ? ` · ${state.preview}` : ""}`;
+}
+
+function terminalStatus(event: MonitorEvent): AgentNodeStatus {
+	if (event.kind === "output") return "done";
+	// Only the manager's status line decides: a failed child's stdout/stderr tail can say anything.
+	if (event.kind === "exit") return CLEAN_EXIT.test(firstLine(event.text)) ? "done" : "failed";
+	return "failed";
+}
+
+export class WakeRows {
+	private readonly monitors = new Map<string, MonitorState>();
+
+	monitorArmed(entry: MonitorEntry): AddNodeInput {
+		const counted = entry.mode === "output";
+		const displayId = clamp(oneLine(entry.id), SUMMARY_MAX);
+		const state: MonitorState = {
+			displayId,
+			mode: entry.mode,
+			stdout: new MonitorOutputTail(),
+			stderr: new MonitorOutputTail(),
+			preview: "",
+			latestStream: "stdout",
+			outputPending: false,
+			base: [
+				`${displayId} · ${entry.mode} mode`,
+				clamp(oneLine(`command: ${[entry.command, ...entry.args].join(" ")}`), COMMAND_LINE_MAX),
+				clamp(oneLine(`cwd: ${entry.cwd}`), COMMAND_LINE_MAX),
+				`armed ${iso(entry.startedAtEpochMs)} · deadline ${iso(entry.expiresAtEpochMs)}`,
+			],
+			maxEvents: entry.maxEvents,
+			counted,
+			events: 0,
+			lines: [],
+		};
+		this.monitors.set(entry.id, state);
+		return {
+			id: wakeNodeId("monitor", entry.id),
+			label: clamp(oneLine(entry.label), SUMMARY_MAX),
+			kind: "monitor",
+			status: "running",
+			detail: `${displayId} · ${entry.mode}`,
+			startedAt: entry.startedAtEpochMs,
+			lastAdvanceAt: entry.startedAtEpochMs,
+			dueAt: entry.expiresAtEpochMs,
+			output: renderMonitorOutput(state),
+		};
+	}
+
+	/** Feed bounded tails immediately; no full-tail reads, tree patches or semantic credit per chunk. */
+	monitorOutput(output: MonitorOutput): boolean {
+		const state = this.monitors.get(output.id);
+		if (!state) return false;
+		state[output.stream].append(output.text);
+		state.latestStream = output.stream;
+		state.outputPending = true;
+		return true;
+	}
+
+	/** Called by the existing UI frame BEFORE composing the widget, once per dirty monitor. */
+	flushMonitorOutput(): WakeRowChange[] {
+		const changes: WakeRowChange[] = [];
+		for (const [id, state] of this.monitors) {
+			if (!state.outputPending) continue;
+			refreshMonitorPreview(state);
+			changes.push({ id: wakeNodeId("monitor", id), patch: { detail: monitorDetail(state), output: renderMonitorOutput(state) } });
+		}
+		return changes;
+	}
+
+	/** Shutdown owns the final archive capture, not another UI frame. Late output is ignored. */
+	clearMonitors(): void {
+		this.monitors.clear();
+	}
+
+	monitorEvent(event: MonitorEvent): WakeRowEvent {
+		const state = this.monitors.get(event.id);
+		const head = clamp(oneLine(firstLine(event.text)), EVENT_TEXT_MAX);
+		let observed = 1;
+		if (state) {
+			refreshMonitorPreview(state);
+			if (event.kind === "output") state.events += 1;
+			observed = state.events;
+			state.lines.push(`[${iso(event.atEpochMs)}] ${head}`);
+			if (state.lines.length > MAX_EVENT_LINES) state.lines.splice(0, state.lines.length - MAX_EVENT_LINES);
+		}
+		const max = state ? String(state.maxEvents) : "?";
+		const displayId = state?.displayId ?? clamp(oneLine(event.id), SUMMARY_MAX);
+
+		const patch: AgentNodePatch = { lastAdvanceAt: event.atEpochMs };
+		if (event.terminal) {
+			patch.status = terminalStatus(event);
+			patch.detail = `${displayId} · ${event.kind === "output" ? `${observed}/${max} events · watch ended` : clamp(head, SUMMARY_MAX)}`;
+		} else if (event.kind === "output") {
+			patch.detail = state?.preview ? monitorDetail(state) : `${displayId} · output · ${observed}/${max} events`;
+		}
+		if (state) patch.output = renderMonitorOutput(state);
+		if (event.terminal) this.monitors.delete(event.id);
+		return { id: wakeNodeId("monitor", event.id), patch, settled: event.terminal };
+	}
+
+	monitorRemoved(entry: MonitorEntry): WakeRowChange {
+		const state = this.monitors.get(entry.id);
+		const output = state?.outputPending ? renderMonitorOutput(state) : undefined;
+		this.monitors.delete(entry.id);
+		return { id: wakeNodeId("monitor", entry.id), patch: { status: "stopped", detail: `${clamp(oneLine(entry.id), SUMMARY_MAX)} · cancelled`, ...(output !== undefined ? { output } : {}) } };
+	}
+
+	timerArmed(entry: TimerEntry): AddNodeInput {
+		return {
+			id: wakeNodeId("timer", entry.id),
+			label: clamp(entry.label, TIMER_LABEL_MAX),
+			kind: "timer",
+			status: "running",
+			// A timer armed without a label is already labelled by its id; do not repeat it.
+			...(entry.label !== entry.id ? { detail: entry.id } : {}),
+			startedAt: entry.armedAtEpochMs,
+			lastAdvanceAt: entry.armedAtEpochMs,
+			dueAt: entry.fireAtEpochMs,
+			output: `${entry.id} · fires ${iso(entry.fireAtEpochMs)} (armed ${iso(entry.armedAtEpochMs)})\nmessage: ${entry.message}`,
+		};
+	}
+
+	timerFired(entry: TimerEntry): WakeRowChange {
+		return { id: wakeNodeId("timer", entry.id), patch: { status: "done", detail: `${entry.id} · fired` } };
+	}
+
+	timerCancelled(entry: TimerEntry): WakeRowChange {
+		return { id: wakeNodeId("timer", entry.id), patch: { status: "stopped", detail: `${entry.id} · cancelled` } };
+	}
+}

package/teams.yaml

@@ -4,15 +4,19 @@
 # not one .md per perspective). Referenced by a persona's `orchestration.roster` / `council.roster`.
 # Project/user copies override.
 
-# One `reviewer` agent, three complementary lenses — the role focuses each parallel pass
+# One `reviewer` agent, four complementary lenses — the role focuses each parallel pass
 # (skills load the rest). Add `model: <provider/id>` to a member for cross-model diversity.
 # Pin cheap models on WORKER members here; leave the SUPERVISOR on the session model (a weak
 # supervisor is the least able to act on its delegation reflex).
 review:
+  - { agent: reviewer, role: "Focus ONLY on the CORRECTNESS lens: wrong logic, off-by-one, races, null/undefined, unhandled errors, broken invariants, wrong API or contract use." }
   - { agent: reviewer, role: "Focus ONLY on the SECURITY lens: unsafe input flows, access control, sensitive data handling, unsafe sinks, input validation." }
   - { agent: reviewer, role: "Focus ONLY on the PERFORMANCE lens: algorithmic cost on hot paths, needless allocations/copies, repeated or N+1 I/O, unbounded work." }
   - { agent: reviewer, role: "Focus ONLY on the TESTS lens: untested branches and edge/error cases, brittle or mock-asserting tests, missing regression pins." }
 
+# design (critic-loop): `architect` drafts ONE plan, `reviewer` critiques it, revised until nothing must-fix remains.
+design: [architect, reviewer]
+
 repair: [operator, verifier]
 # Evidence assurance: execute one bounded leg, then independently replay its proof. Used by Elite's
 # on-demand critic-loop council; unlike the software verifier, this checks objective/scope/artifacts.