@ai-dev-methodologies/rlp-desk 0.5.0 → 0.5.2

package/src/scripts/lib_ralph_desk.zsh

@@ -95,12 +95,7 @@ get_next_model() {
     gpt-5.3-codex-spark:medium) echo "gpt-5.3-codex-spark:high"   ;;
     gpt-5.3-codex-spark:high)   echo "gpt-5.3-codex-spark:xhigh"  ;;
     gpt-5.3-codex-spark:xhigh)  echo ""                           ;;  # spark ceiling (full name)
-    # Codex standard (gpt-5.3-codex) upgrade path
-    gpt-5.3-codex:low)    echo "gpt-5.3-codex:medium" ;;
-    gpt-5.3-codex:medium) echo "gpt-5.3-codex:high"   ;;
-    gpt-5.3-codex:high)   echo "gpt-5.3-codex:xhigh"  ;;
-    gpt-5.3-codex:xhigh)  echo ""                     ;;  # codex ceiling
-    # Codex Non-Pro / upper path
+    # Codex Non-Pro upgrade path
     gpt-5.4:low)    echo "gpt-5.4:medium" ;;
     gpt-5.4:medium) echo "gpt-5.4:high"   ;;
     gpt-5.4:high)   echo "gpt-5.4:xhigh"  ;;
@@ -160,6 +155,7 @@ check_model_upgrade() {
     fi
 
     log "  Worker model upgraded: ${_ORIGINAL_WORKER_MODEL} → ${WORKER_MODEL} (same-US consecutive fail threshold)"
+    log "  [WARN] Same AC failing repeatedly — consider IL-2 re-assessment of AC quality (spec quality check)"
     log_debug "[DECIDE] iter=${ITERATION:-0} phase=model_select model_upgrade=true reason=consecutive_same_ac_fail from=${_ORIGINAL_WORKER_MODEL} to=${WORKER_MODEL}"
     _SAME_US_FAIL_COUNT=0  # Reset counter after upgrade
   fi
@@ -167,6 +163,26 @@ check_model_upgrade() {
   return 0
 }
 
+# record_us_failure() — track per-US cumulative failure count (dual counter, Option D)
+# Unlike CONSECUTIVE_FAILURES which resets on pass, US_FAIL_HISTORY persists across phases.
+# This enables prior-failure warnings when a US that struggled in per-US mode fails again in final verify.
+# Usage: record_us_failure <us_id>
+record_us_failure() {
+  local us_id="$1"
+  [[ -z "$us_id" || "$us_id" = "unknown" ]] && return 0
+
+  local prev_count="${US_FAIL_HISTORY[$us_id]:-0}"
+  US_FAIL_HISTORY[$us_id]=$(( prev_count + 1 ))
+
+  # Prior-failure warning: if this US has failed before, it's showing fragility
+  if (( prev_count > 0 )); then
+    log "  [WARN] US $us_id has prior failure history (${US_FAIL_HISTORY[$us_id]} total failures) — consider IL-2 AC quality re-assessment"
+    log_debug "[GOV] iter=${ITERATION:-0} us_prior_failures=$us_id count=${US_FAIL_HISTORY[$us_id]}"
+  fi
+
+  return 0
+}
+
 # --- governance.md s7: Atomic file writes (tmux pattern) ---
 # All file writes by the Leader use tmp+mv to prevent corruption.
 atomic_write() {
@@ -228,7 +244,7 @@ update_status() {
 
   # Build consensus fields
   local consensus_json=""
-  if [[ "$VERIFY_CONSENSUS" = "1" ]]; then
+  if [[ "$CONSENSUS_MODE" != "off" ]]; then
     consensus_json=',
   "consensus_scope": "'"$CONSENSUS_SCOPE"'",
   "consensus_round": '"$CONSENSUS_ROUND"',
@@ -251,7 +267,7 @@ update_status() {
   "verifier_codex_model": "'"$VERIFIER_CODEX_MODEL"'",
   "verifier_codex_reasoning": "'"$VERIFIER_CODEX_REASONING"'",
   "verify_mode": "'"$VERIFY_MODE"'",
-  "verify_consensus": '"$VERIFY_CONSENSUS"',
+  "consensus_mode": "'"$CONSENSUS_MODE"'",
   "last_result": "'"$last_result"'",
   "consecutive_failures": '"$CONSECUTIVE_FAILURES"',
   "verified_us": '"$verified_us_json"''"$consensus_json"',
@@ -351,9 +367,8 @@ write_cost_log() {
   echo '{"iteration":'"$iter"',"estimated_tokens":'"$estimated_tokens"',"token_source":"estimated","prompt_bytes":'"$prompt_bytes"',"claim_bytes":'"$claim_bytes"',"verdict_bytes":'"$verdict_bytes"',"worker_start_time":"'"$worker_start_time"'","worker_end_time":"'"$worker_end_time"'","worker_duration_s":'"$worker_duration_s"',"verifier_start_time":"'"$verifier_start_time"'","verifier_end_time":"'"$verifier_end_time"'","verifier_duration_s":'"$verifier_duration_s"''"$consensus_fields"',"timestamp":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'"}' >> "$COST_LOG"
 }
 
-# --- Analytics: write per-iteration structured data to campaign.jsonl ---
+# --- Analytics: write per-iteration structured data to campaign.jsonl (always-on) ---
 write_campaign_jsonl() {
-  if (( ! DEBUG )) && (( ! WITH_SELF_VERIFICATION )); then return 0; fi
   local iter="$1"
   local us_id="${2:-unknown}"
   local verdict="${3:-unknown}"
@@ -367,6 +382,19 @@ write_campaign_jsonl() {
     verifier_duration_s=$(( ${ITER_VERIFIER_END:-$(date +%s)} - ITER_VERIFIER_START ))
   fi
 
+  # Build us_fail_history JSON object from associative array
+  local us_fail_history_json="{}"
+  if (( ${#US_FAIL_HISTORY[@]} > 0 )); then
+    us_fail_history_json="{"
+    local first=1
+    for key in "${(@k)US_FAIL_HISTORY}"; do
+      (( first )) || us_fail_history_json+=","
+      us_fail_history_json+="\"$key\":${US_FAIL_HISTORY[$key]}"
+      first=0
+    done
+    us_fail_history_json+="}"
+  fi
+
   jq -nc \
     --argjson iter "$iter" \
     --arg us_id "$us_id" \
@@ -375,13 +403,16 @@ write_campaign_jsonl() {
     --arg verifier_engine "$VERIFIER_ENGINE" \
     --arg claude_verdict "${CLAUDE_VERDICT:-$verdict}" \
     --arg codex_verdict "${CODEX_VERDICT:-N/A}" \
-    --argjson consensus "$VERIFY_CONSENSUS" \
+    --arg consensus_mode "$CONSENSUS_MODE" \
+    --argjson consecutive_failures "$CONSECUTIVE_FAILURES" \
+    --argjson model_upgraded "${_MODEL_UPGRADED:-0}" \
+    --argjson us_fail_history "$us_fail_history_json" \
     --argjson duration_worker_s "$worker_duration_s" \
     --argjson duration_verifier_s "$verifier_duration_s" \
     --arg project_root "$ROOT" \
     --arg slug "$SLUG" \
     --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-    '{iter: $iter, us_id: $us_id, worker_model: $worker_model, worker_engine: $worker_engine, verifier_engine: $verifier_engine, claude_verdict: $claude_verdict, codex_verdict: $codex_verdict, consensus: $consensus, duration_worker_s: $duration_worker_s, duration_verifier_s: $duration_verifier_s, project_root: $project_root, slug: $slug, timestamp: $timestamp}' \
+    '{iter: $iter, us_id: $us_id, worker_model: $worker_model, worker_engine: $worker_engine, verifier_engine: $verifier_engine, claude_verdict: $claude_verdict, codex_verdict: $codex_verdict, consensus_mode: $consensus_mode, consecutive_failures: $consecutive_failures, model_upgraded: $model_upgraded, us_fail_history: $us_fail_history, duration_worker_s: $duration_worker_s, duration_verifier_s: $duration_verifier_s, project_root: $project_root, slug: $slug, timestamp: $timestamp}' \
     >> "$CAMPAIGN_JSONL"
 }
 
@@ -431,7 +462,7 @@ ${untracked}"
   local sv_summary=""
   if (( WITH_SELF_VERIFICATION )); then
     local sv_report
-    sv_report=$(ls -t "$ANALYTICS_DIR"/self-verification-report-*.md 2>/dev/null | head -1)
+    sv_report=$(ls -t "$LOGS_DIR"/self-verification-report-*.md 2>/dev/null | head -1)
     if [[ -n "$sv_report" ]]; then
       sv_summary="See: $sv_report"
     else
@@ -460,7 +491,7 @@ ${untracked}"
     echo "- Elapsed: ${elapsed}s"
     echo "- Worker model: $WORKER_MODEL ($WORKER_ENGINE)"
     echo "- Verifier model: $VERIFIER_MODEL ($VERIFIER_ENGINE)"
-    echo "- Consensus: verify_consensus=$VERIFY_CONSENSUS consensus_scope=$CONSENSUS_SCOPE final_consensus=$FINAL_CONSENSUS"
+    echo "- Consensus: mode=$CONSENSUS_MODE model=$CONSENSUS_MODEL final_model=$FINAL_CONSENSUS_MODEL"
     echo ""
     echo "## US Status"
     echo "- Verified: ${VERIFIED_US:-none}"

package/src/scripts/run_ralph_desk.zsh

@@ -47,8 +47,9 @@ set -uo pipefail
 SLUG="${LOOP_NAME:?ERROR: LOOP_NAME is required. Set it to the campaign slug.}"
 ROOT="${ROOT:-$PWD}"
 MAX_ITER="${MAX_ITER:-20}"
-WORKER_MODEL="${WORKER_MODEL:-sonnet}"
-VERIFIER_MODEL="${VERIFIER_MODEL:-opus}"
+WORKER_MODEL="${WORKER_MODEL:-haiku}"
+VERIFIER_MODEL="${VERIFIER_MODEL:-sonnet}"
+FINAL_VERIFIER_MODEL="${FINAL_VERIFIER_MODEL:-opus}"
 POLL_INTERVAL="${POLL_INTERVAL:-5}"
 ITER_TIMEOUT="${ITER_TIMEOUT:-600}"
 HEARTBEAT_STALE_THRESHOLD="${HEARTBEAT_STALE_THRESHOLD:-120}"
@@ -60,6 +61,7 @@ WITH_SELF_VERIFICATION="${WITH_SELF_VERIFICATION:-0}"
 # --- Engine Selection ---
 WORKER_ENGINE="${WORKER_ENGINE:-claude}"    # claude|codex
 VERIFIER_ENGINE="${VERIFIER_ENGINE:-claude}"  # claude|codex
+FINAL_VERIFIER_ENGINE="${FINAL_VERIFIER_ENGINE:-claude}"  # claude|codex (derived from FINAL_VERIFIER_MODEL)
 WORKER_CODEX_MODEL="${WORKER_CODEX_MODEL:-gpt-5.4}"
 WORKER_CODEX_REASONING="${WORKER_CODEX_REASONING:-high}"   # low|medium|high
 VERIFIER_CODEX_MODEL="${VERIFIER_CODEX_MODEL:-gpt-5.4}"
@@ -68,13 +70,19 @@ CODEX_BIN=""  # resolved by check_dependencies when engine=codex
 
 # --- Verify Mode ---
 VERIFY_MODE="${VERIFY_MODE:-per-us}"        # per-us|batch
-VERIFY_CONSENSUS="${VERIFY_CONSENSUS:-0}"   # 0|1
-FINAL_CONSENSUS="${FINAL_CONSENSUS:-0}"     # 0|1 — consensus for final ALL verify only (independent of VERIFY_CONSENSUS)
-CONSENSUS_SCOPE="${CONSENSUS_SCOPE:-all}"   # all|final-only
-CONSENSUS_FAIL_FAST="${CONSENSUS_FAIL_FAST:-0}" # 0|1 — skip second verifier if first fails
-CB_THRESHOLD="${CB_THRESHOLD:-3}"           # consecutive failures before BLOCKED (default: 3)
-# Effective CB threshold: doubled when consensus mode active (AC2 auto-double)
+# Consensus: off|all|final-only (replaces VERIFY_CONSENSUS + FINAL_CONSENSUS + CONSENSUS_SCOPE)
+CONSENSUS_MODE="${CONSENSUS_MODE:-off}"     # off|all|final-only
+CONSENSUS_MODEL="${CONSENSUS_MODEL:-gpt-5.4:medium}"       # per-US cross-verifier (lighter)
+FINAL_CONSENSUS_MODEL="${FINAL_CONSENSUS_MODEL:-gpt-5.4:high}"  # final cross-verifier (stricter)
+# Legacy compat: map old flags to CONSENSUS_MODE
 if [[ "${VERIFY_CONSENSUS:-0}" = "1" ]]; then
+  CONSENSUS_MODE="${CONSENSUS_SCOPE:-all}"
+elif [[ "${FINAL_CONSENSUS:-0}" = "1" ]]; then
+  CONSENSUS_MODE="final-only"
+fi
+CB_THRESHOLD="${CB_THRESHOLD:-6}"           # consecutive failures before BLOCKED (default: 6)
+# Effective CB threshold: doubled when consensus mode active
+if [[ "$CONSENSUS_MODE" != "off" ]]; then
   EFFECTIVE_CB_THRESHOLD=$(( CB_THRESHOLD * 2 ))
 else
   EFFECTIVE_CB_THRESHOLD=$CB_THRESHOLD
@@ -120,6 +128,7 @@ SESSION_NAME="rlp-desk-${SLUG}-${TIMESTAMP}"
 typeset -A LAST_PANE_CONTENT
 typeset -A PANE_IDLE_SINCE
 typeset -A WORKER_RESTARTS
+typeset -A US_FAIL_HISTORY
 STALE_CONTEXT_COUNT=0
 HEARTBEAT_STALE_COUNT=0
 MONITOR_FAILURE_COUNT=0
@@ -192,7 +201,7 @@ launch_worker_codex() {
 
   log "  Launching Worker codex via trigger script in pane $pane_id..."
   paste_to_pane "$pane_id" "bash $trigger_file"
-  tmux send-keys -t "$pane_id" Enter
+  tmux send-keys -t "$pane_id" C-m
   log_debug "Worker codex trigger sent: $trigger_file"
   sleep 3  # brief wait for codex to start
   return 0
@@ -211,7 +220,7 @@ launch_worker_claude() {
 
   log "  Launching Worker claude in pane $pane_id..."
   paste_to_pane "$pane_id" "$worker_launch"
-  tmux send-keys -t "$pane_id" Enter
+  tmux send-keys -t "$pane_id" C-m
 
   # Wait for claude TUI to be ready
   if ! wait_for_pane_ready "$pane_id" 30; then
@@ -223,7 +232,7 @@ launch_worker_claude() {
   sleep 3
   local worker_instruction="Read and execute the instructions in $prompt_file"
   paste_to_pane "$pane_id" "$worker_instruction"
-  tmux send-keys -t "$pane_id" Enter
+  tmux send-keys -t "$pane_id" C-m
   log_debug "Worker instruction sent directly (${#worker_instruction} chars)"
 
   # 15-iteration submit loop — verify claude started working
@@ -244,7 +253,7 @@ launch_worker_claude() {
       sleep 0.2
       paste_to_pane "$pane_id" "$worker_instruction"
       sleep 0.15
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
       sleep 1
     fi
     tmux send-keys -t "$pane_id" C-m 2>/dev/null
@@ -259,15 +268,15 @@ launch_worker_claude() {
     log_debug "[GOV] iter=$iter worker_instruction_failed=true attempts=15 action=restart_claude"
     tmux send-keys -t "$pane_id" C-c 2>/dev/null
     sleep 0.5
-    tmux send-keys -t "$pane_id" "/exit" Enter 2>/dev/null
+    tmux send-keys -t "$pane_id" "/exit" C-m 2>/dev/null
     sleep 2
     wait_for_pane_ready "$pane_id" 10 2>/dev/null || true
     paste_to_pane "$pane_id" "$worker_launch"
-    tmux send-keys -t "$pane_id" Enter
+    tmux send-keys -t "$pane_id" C-m
     if wait_for_pane_ready "$pane_id" 30; then
       sleep 3
       paste_to_pane "$pane_id" "$worker_instruction"
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
       log "  Worker restarted and instruction re-sent"
       log_debug "[FLOW] iter=$iter worker_restart_recovery=success"
     else
@@ -290,7 +299,7 @@ launch_verifier_codex() {
 
   log "  Launching Verifier codex in pane $pane_id..."
   paste_to_pane "$pane_id" "$verifier_launch"
-  tmux send-keys -t "$pane_id" Enter
+  tmux send-keys -t "$pane_id" C-m
   sleep 3
   return 0
 }
@@ -306,7 +315,7 @@ launch_verifier_claude() {
 
   log "  Launching Verifier claude in pane $pane_id..."
   paste_to_pane "$pane_id" "$verifier_launch"
-  tmux send-keys -t "$pane_id" Enter
+  tmux send-keys -t "$pane_id" C-m
 
   if ! wait_for_pane_ready "$pane_id" 30; then
     log_error "Verifier failed to start"
@@ -316,7 +325,7 @@ launch_verifier_claude() {
   sleep 3
   local verifier_instruction="Read and execute the instructions in $prompt_file"
   paste_to_pane "$pane_id" "$verifier_instruction"
-  tmux send-keys -t "$pane_id" Enter
+  tmux send-keys -t "$pane_id" C-m
   log_debug "Verifier instruction sent directly"
 
   # Submit loop — verify verifier started working
@@ -334,7 +343,7 @@ launch_verifier_claude() {
       tmux send-keys -t "$pane_id" C-u 2>/dev/null
       sleep 0.1
       paste_to_pane "$pane_id" "$verifier_instruction"
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
     fi
     tmux send-keys -t "$pane_id" C-m 2>/dev/null
     sleep 0.3
@@ -455,7 +464,7 @@ check_dependencies() {
   fi
 
   # Codex binary required only when engine=codex or consensus verification is enabled
-  if [[ "$WORKER_ENGINE" = "codex" || "$VERIFIER_ENGINE" = "codex" || "$VERIFY_CONSENSUS" = "1" || "$FINAL_CONSENSUS" = "1" ]]; then
+  if [[ "$WORKER_ENGINE" = "codex" || "$VERIFIER_ENGINE" = "codex" || "$CONSENSUS_MODE" != "off" ]]; then
     if ! command -v codex >/dev/null 2>&1; then
       log_error "codex CLI not found. Install: npm install -g @openai/codex"
       missing=1
@@ -473,7 +482,7 @@ check_dependencies() {
   fi
 
   # Resolve codex binary if needed
-  if [[ "$WORKER_ENGINE" = "codex" || "$VERIFIER_ENGINE" = "codex" || "$VERIFY_CONSENSUS" = "1" || "$FINAL_CONSENSUS" = "1" ]]; then
+  if [[ "$WORKER_ENGINE" = "codex" || "$VERIFIER_ENGINE" = "codex" || "$CONSENSUS_MODE" != "off" ]]; then
     CODEX_BIN=$(command -v codex 2>/dev/null || echo "codex")
     log "  Codex binary:  $CODEX_BIN"
   fi
@@ -531,7 +540,7 @@ create_session() {
   # Set pane titles and enable border labels for visual distinction
   local worker_label="Worker ($WORKER_ENGINE:$WORKER_MODEL)"
   local verifier_label="Verifier ($VERIFIER_ENGINE:$VERIFIER_MODEL)"
-  [[ "$VERIFY_CONSENSUS" = "1" ]] && verifier_label="Verifier ($VERIFIER_ENGINE:$VERIFIER_MODEL + codex:$VERIFIER_CODEX_MODEL)"
+  [[ "$CONSENSUS_MODE" != "off" ]] && verifier_label="Verifier ($VERIFIER_ENGINE:$VERIFIER_MODEL + consensus)"
   tmux select-pane -t "$LEADER_PANE" -T "Leader" 2>/dev/null
   tmux select-pane -t "$WORKER_PANE" -T "$worker_label" 2>/dev/null
   tmux select-pane -t "$VERIFIER_PANE" -T "$verifier_label" 2>/dev/null
@@ -585,8 +594,7 @@ create_session() {
   },
   "verification": {
     "verify_mode": "'"$VERIFY_MODE"'",
-    "verify_consensus": '"$VERIFY_CONSENSUS"',
-    "consensus_scope": "'"$CONSENSUS_SCOPE"'"
+    "consensus_mode": "'"$CONSENSUS_MODE"'"
   },
   "config": {
     "max_iter": '"$MAX_ITER"',
@@ -663,13 +671,13 @@ safe_send_keys() {
   # Auto-approve permission prompts ("Do you want to create/overwrite X?")
   if echo "$initial_capture" | grep -q "Do you want to" 2>/dev/null; then
     log_debug " Permission prompt detected, auto-approving"
-    tmux send-keys -t "$pane_id" Enter
+    tmux send-keys -t "$pane_id" C-m
     sleep 0.3
   fi
   # Auto-dismiss codex update prompt (select Skip)
   if echo "$initial_capture" | grep -qi "new version\|update.*codex\|codex.*update" 2>/dev/null; then
     log_debug " Codex update prompt detected, selecting Skip"
-    tmux send-keys -t "$pane_id" "2" Enter
+    tmux send-keys -t "$pane_id" "2" C-m
     sleep 0.2
   fi
   # Send text via buffer paste (reliable for long strings)
@@ -761,9 +769,9 @@ wait_for_pane_ready() {
     # Auto-dismiss trust prompt (tmux pattern: paneHasTrustPrompt)
     if echo "$captured" | grep -q "Do you trust" 2>/dev/null; then
       log "  Trust prompt detected, auto-dismissing..."
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
       sleep 0.12
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
       sleep 2
       continue
     fi
@@ -771,7 +779,7 @@ wait_for_pane_ready() {
     # Auto-approve permission prompts ("Do you want to create/overwrite X?")
     if echo "$captured" | grep -q "Do you want to" 2>/dev/null; then
       log "  Permission prompt detected, auto-approving..."
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
       sleep 0.5
       continue
     fi
@@ -779,7 +787,7 @@ wait_for_pane_ready() {
     # Auto-dismiss codex update prompt (select Skip = option 2)
     if echo "$captured" | grep -qi "new version\|update.*codex\|codex.*update" 2>/dev/null; then
       log "  Codex update prompt detected, selecting Skip..."
-      tmux send-keys -t "$pane_id" "2" Enter
+      tmux send-keys -t "$pane_id" "2" C-m
       sleep 0.5
       continue
     fi
@@ -917,7 +925,7 @@ restart_worker() {
 
   # Kill existing claude, wait for shell prompt
   tmux send-keys -t "$pane_id" C-c 2>/dev/null
-  tmux send-keys -t "$pane_id" "/exit" Enter 2>/dev/null
+  tmux send-keys -t "$pane_id" "/exit" C-m 2>/dev/null
   sleep 2
 
   # Re-launch worker (tmux interactive pattern)
@@ -1205,11 +1213,11 @@ cleanup() {
   log_debug "cleanup: WORKER_PANE=${WORKER_PANE:-unset} VERIFIER_PANE=${VERIFIER_PANE:-unset}"
   if [[ -n "${WORKER_PANE:-}" ]]; then
     tmux send-keys -t "$WORKER_PANE" C-c 2>/dev/null
-    tmux send-keys -t "$WORKER_PANE" "/exit" Enter 2>/dev/null
+    tmux send-keys -t "$WORKER_PANE" "/exit" C-m 2>/dev/null
   fi
   if [[ -n "${VERIFIER_PANE:-}" ]]; then
     tmux send-keys -t "$VERIFIER_PANE" C-c 2>/dev/null
-    tmux send-keys -t "$VERIFIER_PANE" "/exit" Enter 2>/dev/null
+    tmux send-keys -t "$VERIFIER_PANE" "/exit" C-m 2>/dev/null
   fi
   sleep 2
   # Kill panes on completion
@@ -1284,11 +1292,11 @@ cleanup() {
     fi
 
     # 3. Consensus: were both engines used?
-    if [[ "$VERIFY_CONSENSUS" = "1" ]]; then
+    if [[ "$CONSENSUS_MODE" != "off" ]]; then
       if [[ -n "${CLAUDE_VERDICT:-}" && -n "${CODEX_VERDICT:-}" ]]; then
-        log_debug "[FLOW] consensus=USED claude=$CLAUDE_VERDICT codex=$CODEX_VERDICT rounds=$CONSENSUS_ROUND"
+        log_debug "[FLOW] consensus=USED mode=$CONSENSUS_MODE claude=$CLAUDE_VERDICT codex=$CODEX_VERDICT rounds=$CONSENSUS_ROUND"
       else
-        log_debug "[FLOW] consensus=NOT_TRIGGERED claude=${CLAUDE_VERDICT:-none} codex=${CODEX_VERDICT:-none}"
+        log_debug "[FLOW] consensus=NOT_TRIGGERED mode=$CONSENSUS_MODE claude=${CLAUDE_VERDICT:-none} codex=${CODEX_VERDICT:-none}"
       fi
     fi
 
@@ -1410,7 +1418,7 @@ poll_for_signal() {
         log "  A5: Rate-limited pane shows 'queued messages' — restarting $role pane"
         log_debug "[GOV] iter=$ITERATION phase=rate_limit_pane_restart role=$role reason=queued_messages"
         tmux send-keys -t "$pane_id" C-c 2>/dev/null; sleep 0.5
-        tmux send-keys -t "$pane_id" "/exit" Enter 2>/dev/null; sleep 2
+        tmux send-keys -t "$pane_id" "/exit" C-m 2>/dev/null; sleep 2
         wait_for_pane_ready "$pane_id" 10 2>/dev/null || true
       fi
       sleep "$_API_RETRY_INTERVAL_S"
@@ -1487,7 +1495,7 @@ poll_for_signal() {
     if echo "$poll_capture" | grep -q "Do you want to" 2>/dev/null; then
       log "  Permission prompt detected during poll, auto-approving..."
       log_debug "[FLOW] iter=$ITERATION permission_prompt_auto_approved=true"
-      tmux send-keys -t "$pane_id" Enter
+      tmux send-keys -t "$pane_id" C-m
       sleep 0.5
     fi
 
@@ -1529,12 +1537,12 @@ run_single_verifier() {
     log_debug "[GOV] iter=$iter pane_dead=true pane_id=$VERIFIER_PANE cmd=$verifier_cmd action=reset_shell"
     tmux send-keys -t "$VERIFIER_PANE" C-c C-u 2>/dev/null
     sleep 0.2
-    tmux send-keys -t "$VERIFIER_PANE" "clear" Enter 2>/dev/null
+    tmux send-keys -t "$VERIFIER_PANE" "clear" C-m 2>/dev/null
     sleep 0.3
   elif [[ "$verifier_cmd" == "node" || "$verifier_cmd" == "claude" || "$verifier_cmd" == "codex" ]]; then
     tmux send-keys -t "$VERIFIER_PANE" C-c 2>/dev/null
     sleep 0.5
-    tmux send-keys -t "$VERIFIER_PANE" "/exit" Enter 2>/dev/null
+    tmux send-keys -t "$VERIFIER_PANE" "/exit" C-m 2>/dev/null
     sleep 2
   fi
   # Always ensure clean shell state before launching new verifier
@@ -1628,7 +1636,7 @@ run_sequential_final_verify() {
     verifier_cmd=$(tmux display-message -p -t "$VERIFIER_PANE" '#{pane_current_command}' 2>/dev/null)
     if [[ "$verifier_cmd" == "node" || "$verifier_cmd" == "claude" || "$verifier_cmd" == "codex" ]]; then
       tmux send-keys -t "$VERIFIER_PANE" C-c 2>/dev/null; sleep 0.5
-      tmux send-keys -t "$VERIFIER_PANE" "/exit" Enter 2>/dev/null; sleep 2
+      tmux send-keys -t "$VERIFIER_PANE" "/exit" C-m 2>/dev/null; sleep 2
     fi
     wait_for_pane_ready "$VERIFIER_PANE" 10 2>/dev/null || true
 
@@ -1689,20 +1697,14 @@ run_sequential_final_verify() {
 
 # --- US-005: Determine whether consensus verification should run for this signal ---
 # Returns 0 (use consensus) or 1 (single engine).
-# VERIFY_CONSENSUS + CONSENSUS_SCOPE handles per-US consensus.
-# FINAL_CONSENSUS independently enables consensus for the final ALL verify only.
+# Uses unified CONSENSUS_MODE: off|all|final-only
 _should_use_consensus() {
   local signal_us_id="${1:-}"
-  if [[ "$VERIFY_CONSENSUS" = "1" ]]; then
-    case "$CONSENSUS_SCOPE" in
-      all) return 0 ;;
-      final-only) [[ "$signal_us_id" == "ALL" ]] && return 0 ;;
-    esac
-  fi
-  if [[ "$FINAL_CONSENSUS" = "1" && "$signal_us_id" == "ALL" ]]; then
-    return 0
-  fi
-  return 1
+  case "$CONSENSUS_MODE" in
+    all) return 0 ;;
+    final-only) [[ "$signal_us_id" == "ALL" ]] && return 0 ;;
+    off|*) return 1 ;;
+  esac
 }
 
 # --- US-004: Run consensus verification (claude + codex sequentially) ---
@@ -1744,13 +1746,7 @@ run_consensus_verification() {
     fi
     log_debug "[GOV] iter=$iter phase=consensus_claude verdict=$CLAUDE_VERDICT model=$VERIFIER_MODEL"
 
-    # F8: --consensus-fail-fast — skip second verifier if first fails
-    if [[ "$CONSENSUS_FAIL_FAST" = "1" && "$CLAUDE_VERDICT" = "fail" ]]; then
-      log "  Consensus fail-fast: claude=fail, skipping codex verifier"
-      log_debug "[GOV] iter=$iter phase=consensus_fail_fast claude=fail codex=skipped"
-      CODEX_VERDICT="skipped"
-      return 2  # disagreement/fail signal
-    fi
+    # consensus-fail-fast removed (complexity vs value too low)
 
     # Run codex verifier second
     local _codex_t0=$(date +%s)
@@ -1887,12 +1883,10 @@ main() {
   trap cleanup EXIT INT TERM
   mkdir -p "$LOGS_DIR" "$RUNTIME_DIR" 2>/dev/null
 
-  # --- Analytics directory: create only when --debug or --with-self-verification ---
-  if (( DEBUG )) || (( WITH_SELF_VERIFICATION )); then
-    mkdir -p "$ANALYTICS_DIR" 2>/dev/null
-  fi
+  # --- Analytics directory: always create (campaign.jsonl + metadata.json are always-on) ---
+  mkdir -p "$ANALYTICS_DIR" 2>/dev/null
 
-  # --- debug.log versioning (in analytics dir) ---
+  # --- debug.log versioning (in analytics dir, --debug only) ---
   if (( DEBUG )) && [[ -f "$DEBUG_LOG" ]]; then
     local dbg_n=1
     while [[ -f "${DEBUG_LOG%.log}-v${dbg_n}.log" ]]; do
@@ -1901,33 +1895,30 @@ main() {
     mv "$DEBUG_LOG" "${DEBUG_LOG%.log}-v${dbg_n}.log"
   fi
 
-  # --- campaign.jsonl versioning (in analytics dir, after mkdir) ---
-  if (( DEBUG )) || (( WITH_SELF_VERIFICATION )); then
-    if [[ -f "$CAMPAIGN_JSONL" ]]; then
-      local cj_n=1
-      while [[ -f "${CAMPAIGN_JSONL%.jsonl}-v${cj_n}.jsonl" ]]; do
-        (( cj_n++ ))
-      done
-      mv "$CAMPAIGN_JSONL" "${CAMPAIGN_JSONL%.jsonl}-v${cj_n}.jsonl"
-    fi
+  # --- campaign.jsonl versioning (always-on) ---
+  if [[ -f "$CAMPAIGN_JSONL" ]]; then
+    local cj_n=1
+    while [[ -f "${CAMPAIGN_JSONL%.jsonl}-v${cj_n}.jsonl" ]]; do
+      (( cj_n++ ))
+    done
+    mv "$CAMPAIGN_JSONL" "${CAMPAIGN_JSONL%.jsonl}-v${cj_n}.jsonl"
   fi
 
-  # --- metadata.json: write at campaign start ---
-  if (( DEBUG )) || (( WITH_SELF_VERIFICATION )); then
-    jq -n \
-      --arg slug "$SLUG" \
-      --arg project_root "$ROOT" \
-      --arg campaign_status "running" \
-      --arg start_time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-      --arg end_time "" \
-      --arg worker_model "$WORKER_MODEL" \
-      --arg verifier_model "$VERIFIER_MODEL" \
-      --argjson debug "$DEBUG" \
-      --argjson with_sv "$WITH_SELF_VERIFICATION" \
-      --argjson consensus "$VERIFY_CONSENSUS" \
-      '{slug: $slug, project_root: $project_root, campaign_status: $campaign_status, start_time: $start_time, end_time: $end_time, worker_model: $worker_model, verifier_model: $verifier_model, debug: $debug, with_self_verification: $with_sv, consensus: $consensus}' \
-      > "$METADATA_FILE"
-  fi
+  # --- metadata.json: always write at campaign start (cross-project identification) ---
+  jq -n \
+    --arg slug "$SLUG" \
+    --arg project_root "$ROOT" \
+    --arg project_name "$(basename "$ROOT")" \
+    --arg campaign_status "running" \
+    --arg start_time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    --arg end_time "" \
+    --arg worker_model "$WORKER_MODEL" \
+    --arg verifier_model "$VERIFIER_MODEL" \
+    --argjson debug "$DEBUG" \
+    --argjson with_sv "$WITH_SELF_VERIFICATION" \
+    --argjson consensus "$VERIFY_CONSENSUS" \
+    '{slug: $slug, project_root: $project_root, project_name: $project_name, campaign_status: $campaign_status, start_time: $start_time, end_time: $end_time, worker_model: $worker_model, verifier_model: $verifier_model, debug: $debug, with_self_verification: $with_sv, consensus: $consensus}' \
+    > "$METADATA_FILE"
 
   # --- Startup ---
   log "Ralph Desk Tmux Runner starting..."
@@ -1935,11 +1926,10 @@ main() {
   log "  Root:            $ROOT"
   log "  Max iterations:  $MAX_ITER"
   log "  Worker model:    $WORKER_MODEL"
-  log "  Verifier model:  $VERIFIER_MODEL"
+  log "  Verifier model:  $VERIFIER_MODEL (per-US) / $FINAL_VERIFIER_MODEL (final)"
   log "  Verify mode:     $VERIFY_MODE"
-  log "  Verify consensus:$VERIFY_CONSENSUS"
-  log "  Final consensus: $FINAL_CONSENSUS"
-  log "  Consensus scope: $CONSENSUS_SCOPE"
+  log "  Consensus mode:  $CONSENSUS_MODE"
+  log "  Consensus model: $CONSENSUS_MODEL (per-US) / $FINAL_CONSENSUS_MODEL (final)"
   log "  Poll interval:   ${POLL_INTERVAL}s"
   log "  Iter timeout:    ${ITER_TIMEOUT}s"
   # --- Debug: Log execution plan ---
@@ -1955,7 +1945,7 @@ main() {
     log_debug "[OPTION] slug=$SLUG us_count=$us_count us_list=$us_list"
     log_debug "[OPTION] worker_engine=$WORKER_ENGINE worker_model=$WORKER_MODEL"
     log_debug "[OPTION] verifier_engine=$VERIFIER_ENGINE verifier_model=$VERIFIER_MODEL"
-    log_debug "[OPTION] verify_mode=$VERIFY_MODE consensus=$VERIFY_CONSENSUS consensus_scope=$CONSENSUS_SCOPE max_iter=$MAX_ITER"
+    log_debug "[OPTION] verify_mode=$VERIFY_MODE consensus_mode=$CONSENSUS_MODE max_iter=$MAX_ITER"
     log_debug "[OPTION] cb_threshold=$CB_THRESHOLD effective_cb_threshold=$EFFECTIVE_CB_THRESHOLD iter_timeout=$ITER_TIMEOUT with_self_verification=$WITH_SELF_VERIFICATION debug=$DEBUG"
 
     if [[ "$VERIFY_MODE" = "per-us" ]]; then
@@ -2065,7 +2055,7 @@ main() {
       # Send C-c first (in case claude is mid-task), then /exit
       tmux send-keys -t "$WORKER_PANE" C-c 2>/dev/null
       sleep 1
-      tmux send-keys -t "$WORKER_PANE" "/exit" Enter 2>/dev/null
+      tmux send-keys -t "$WORKER_PANE" "/exit" C-m 2>/dev/null
       sleep 2
       # Wait for shell prompt before proceeding
       wait_for_pane_ready "$WORKER_PANE" 10 2>/dev/null || true
@@ -2222,7 +2212,7 @@ main() {
           fi
         fi
 
-        # --- Consensus scope check (US-005: _should_use_consensus handles VERIFY_CONSENSUS + FINAL_CONSENSUS) ---
+        # --- Consensus scope check (US-005: _should_use_consensus handles CONSENSUS_MODE) ---
         local use_consensus=0
         _should_use_consensus "$signal_us_id" && use_consensus=1
 
@@ -2261,12 +2251,12 @@ main() {
             log_debug "[GOV] iter=$ITERATION pane_dead=true pane_id=$VERIFIER_PANE cmd=$verifier_cmd action=reset_shell"
             tmux send-keys -t "$VERIFIER_PANE" C-c C-u 2>/dev/null
             sleep 0.2
-            tmux send-keys -t "$VERIFIER_PANE" "clear" Enter 2>/dev/null
+            tmux send-keys -t "$VERIFIER_PANE" "clear" C-m 2>/dev/null
             sleep 0.3
           elif [[ "$verifier_cmd" == "node" || "$verifier_cmd" == "claude" || "$verifier_cmd" == "codex" ]]; then
             tmux send-keys -t "$VERIFIER_PANE" C-c 2>/dev/null
             sleep 0.5
-            tmux send-keys -t "$VERIFIER_PANE" "/exit" Enter 2>/dev/null
+            tmux send-keys -t "$VERIFIER_PANE" "/exit" C-m 2>/dev/null
             sleep 2
           fi
           wait_for_pane_ready "$VERIFIER_PANE" 10 2>/dev/null || true
@@ -2362,7 +2352,14 @@ main() {
           fail)
             # --- governance.md s7½: Fix Loop (adapted for tmux lean mode) ---
             (( CONSECUTIVE_FAILURES++ ))
+            record_us_failure "${signal_us_id:-unknown}"
             check_model_upgrade "${signal_us_id:-unknown}"
+
+            # Mid-CB warning: alert at halfway point (governance §8 early warning)
+            if (( CONSECUTIVE_FAILURES == EFFECTIVE_CB_THRESHOLD / 2 )); then
+              log "  [WARN] Mid-CB: $CONSECUTIVE_FAILURES/${EFFECTIVE_CB_THRESHOLD} consecutive failures — consider reviewing AC quality"
+              log_debug "[GOV] iter=$ITERATION mid_cb_warning=true consecutive_failures=$CONSECUTIVE_FAILURES threshold=$EFFECTIVE_CB_THRESHOLD"
+            fi
             local verdict_summary_fail
             verdict_summary_fail=$(jq -r '.summary // "no summary"' "$VERDICT_FILE" 2>/dev/null)
             log "  Verifier FAILED (consecutive: $CONSECUTIVE_FAILURES). Building fix contract..."
@@ -2498,8 +2495,36 @@ while (( _cli_i <= $# )); do
     --lock-worker-model)
       LOCK_WORKER_MODEL=1
       ;;
+    --final-verifier-model)
+      (( _cli_i++ ))
+      _cli_parsed=$(parse_model_flag "${@[$_cli_i]:-}" "final-verifier") || exit 1
+      FINAL_VERIFIER_ENGINE="${_cli_parsed%% *}"
+      _cli_rest="${_cli_parsed#* }"
+      FINAL_VERIFIER_MODEL="${_cli_rest%% *}"
+      if [[ "$FINAL_VERIFIER_ENGINE" = "codex" ]]; then
+        FINAL_VERIFIER_CODEX_MODEL="$FINAL_VERIFIER_MODEL"
+        FINAL_VERIFIER_CODEX_REASONING="${_cli_rest##* }"
+      fi
+      ;;
+    --consensus)
+      (( _cli_i++ ))
+      CONSENSUS_MODE="${@[$_cli_i]:-off}"
+      ;;
+    --consensus-model)
+      (( _cli_i++ ))
+      CONSENSUS_MODEL="${@[$_cli_i]:-gpt-5.4:medium}"
+      ;;
+    --final-consensus-model)
+      (( _cli_i++ ))
+      FINAL_CONSENSUS_MODEL="${@[$_cli_i]:-gpt-5.4:high}"
+      ;;
     --final-consensus)
-      FINAL_CONSENSUS=1
+      # Legacy: map to new --consensus final-only
+      CONSENSUS_MODE="final-only"
+      ;;
+    --verify-consensus)
+      # Legacy: map to new --consensus all
+      CONSENSUS_MODE="all"
       ;;
   esac
   (( _cli_i++ ))