@amenophis1er/foreman 0.1.17 → 0.1.18

package/src/run-crew.test.ts

@@ -0,0 +1,99 @@
+/**
+ * The run side of crew presets: what dispatch freezes onto a record, and what
+ * a report says about the verdicts it collected.
+ *
+ * The freeze test is the one that matters. It runs the server's own pipeline —
+ * a settings blob, the overlay, the chosen ids — and then does the thing the
+ * whole design exists to survive: it edits the preset afterwards.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { crewPresetsFrom, type CrewPreset, type ReviewVerdict } from './crew.js';
+import { frozenCrewFor, reviewReportLines } from './run-crew.js';
+
+/** What store.readSettings() hands effectiveSettings(), for one project. */
+function settings(): { global: Record<string, unknown>; project: Record<string, unknown> } {
+  return {
+    global: {
+      crewPresets: [
+        { id: 'reviewer', name: 'Reviewer', kind: 'reviewer', brief: 'Review it.', requiredForDone: true, model: 'opus' },
+        { id: 'perf', name: 'Performance', kind: 'reviewer', brief: 'Look at the hot paths.', requiredForDone: false },
+      ],
+    },
+    project: {},
+  };
+}
+
+test('the freeze holds: editing a preset afterwards does not change a past run', () => {
+  const s = settings();
+  // What the server does at dispatch, in the order it does it.
+  const presets = crewPresetsFrom(s.global, s.project);
+  const run: { crew?: CrewPreset[] } = {};
+  const crew = frozenCrewFor(presets, ['reviewer']);
+  if (crew) run.crew = crew;
+  assert.deepEqual(run.crew, [{ id: 'reviewer', name: 'Reviewer', kind: 'reviewer', brief: 'Review it.', requiredForDone: true, model: 'opus' }]);
+
+  // Next week, the human edits the preset in Settings: a different brief, and
+  // the reviewer no longer blocks a run.
+  const source = (s.global.crewPresets as Array<Record<string, unknown>>)[0];
+  source.brief = 'Something else entirely.';
+  source.requiredForDone = false;
+  source.name = 'Renamed';
+  // And the list handed out after the edit is a different list, mutated too.
+  for (const p of presets) { p.brief = 'mutated'; p.requiredForDone = false; }
+
+  assert.equal(run.crew![0].brief, 'Review it.', 'the run keeps the brief it was reviewed against');
+  assert.equal(run.crew![0].requiredForDone, true, 'and the gate it started under');
+  assert.equal(run.crew![0].name, 'Reviewer');
+});
+
+test('crewPresetsFrom overlay: the project replaces the global list whole', () => {
+  const s = settings();
+  s.project.crewPresets = [{ id: 'local', name: 'House reviewer', kind: 'reviewer', brief: 'ours', requiredForDone: true }];
+  assert.deepEqual(crewPresetsFrom(s.global, s.project).map((p) => p.id), ['local']);
+  assert.deepEqual(crewPresetsFrom(s.global, {}).map((p) => p.id), ['reviewer', 'perf']);
+  // The human emptied the project's list: no crew here, not the global one back.
+  assert.deepEqual(crewPresetsFrom(s.global, { crewPresets: [] }), []);
+});
+
+test('frozenCrewFor: nothing chosen leaves the field absent', () => {
+  const presets = crewPresetsFrom(settings().global, {});
+  assert.equal(frozenCrewFor(presets, undefined), undefined);
+  assert.equal(frozenCrewFor(presets, []), undefined);
+  // Only ids nobody has a preset for: still nothing to freeze.
+  assert.equal(frozenCrewFor(presets, ['ghost', '  ']), undefined);
+  assert.deepEqual(frozenCrewFor(presets, ['perf', 'ghost'])?.map((p) => p.id), ['perf']);
+});
+
+const verdict = (over: Partial<ReviewVerdict>): ReviewVerdict => ({
+  presetId: 'reviewer', name: 'Reviewer', pass: true, findings: '', diffHash: 'h1', workerId: 'w1', at: 1, ...over,
+});
+const required = (over: Partial<CrewPreset> = {}): CrewPreset =>
+  ({ id: 'reviewer', name: 'Reviewer', kind: 'reviewer', brief: '', requiredForDone: true, ...over });
+
+test('reviewReportLines: the verdicts, priced when the run was', () => {
+  assert.deepEqual(reviewReportLines([required()], [verdict({ costUsd: 0.42 })]), ['reviews: Reviewer PASS · $0.42']);
+  assert.deepEqual(
+    reviewReportLines([required()], [verdict({ pass: false })]),
+    ['reviews: Reviewer FAIL', '  Reviewer is required for this run to be done and returned FAIL.'],
+  );
+  // Nothing to say about a run that had no crew and collected no verdicts.
+  assert.deepEqual(reviewReportLines(undefined, undefined), []);
+});
+
+test('reviewReportLines: a required reviewer that never ran is named', () => {
+  assert.deepEqual(reviewReportLines([required(), { ...required({ id: 'perf', name: 'Performance' }), requiredForDone: false }], []),
+    ['  Reviewer is required for this run to be done and has not reviewed it.']);
+});
+
+test('reviewReportLines: staleness is claimed only where the diff hash is known', () => {
+  const crew = [required()];
+  const passed = [verdict({ diffHash: 'old' })];
+  // No hash: the report says what the record holds and claims nothing more.
+  assert.deepEqual(reviewReportLines(crew, passed), ['reviews: Reviewer PASS']);
+  assert.deepEqual(reviewReportLines(crew, passed, 'new'), [
+    'reviews: Reviewer PASS',
+    '  Reviewer passed an earlier version of the diff; the code changed after it.',
+  ]);
+  assert.deepEqual(reviewReportLines(crew, passed, 'old'), ['reviews: Reviewer PASS']);
+});

package/src/run-crew.ts

@@ -0,0 +1,101 @@
+/**
+ * The crew as a *run* sees it: what gets frozen onto the record at dispatch,
+ * and how the verdicts it collected read back in a report.
+ *
+ * Both halves are here rather than in crew.ts because crew.ts is the rules —
+ * what a preset is, and what blocks a run — while these are the two places
+ * Foreman's own surfaces touch them: server.ts freezing at dispatch, and
+ * server.ts and mcp.ts writing the same lines to the phone and to MCP. Two
+ * surfaces printing verdicts two different ways is how "PASS" comes to mean
+ * something slightly different depending on where you read it.
+ */
+import { freezeCrew, reviewBlockers, type CrewPreset, type ReviewVerdict } from './crew.js';
+
+/**
+ * The crew to freeze onto a new run, or undefined when there is none.
+ *
+ * undefined rather than [] on purpose: an absent field is how every run
+ * recorded before presets existed reads, and a run dispatched with no crew is
+ * that same run. Unknown ids fall away silently — freezeCrew resolves against
+ * the presets actually in force, so an id from a preset the human has since
+ * deleted cannot conjure a reviewer that no longer exists.
+ */
+export function frozenCrewFor(
+  presets: readonly CrewPreset[],
+  ids: readonly string[] | undefined,
+): CrewPreset[] | undefined {
+  if (!Array.isArray(ids) || ids.length === 0) return undefined;
+  const clean = ids.filter((id): id is string => typeof id === 'string' && id.trim() !== '');
+  const crew = freezeCrew(clean, presets);
+  return crew.length ? crew : undefined;
+}
+
+/**
+ * The reviewers whose PASS this finished run is entitled to wear, or [] .
+ *
+ * Derived here and sent as a name list rather than shipping `reviews` into the
+ * fleet's projection, because that projection exists to stay small: it is
+ * re-polled every few seconds for every project, and a verdict's findings run
+ * to thousands of characters that a tile never renders. The tile asks one
+ * question — "did the required reviewers pass?" — so it is handed the answer.
+ *
+ * Only a run Foreman actually recorded `done` qualifies, and that is what
+ * makes staleness answerable from a record alone: the end-of-run gate refuses
+ * `done` unless every required PASS was pinned to the diff the run ended with,
+ * so a `done` run with all its required verdicts passing was current when it
+ * mattered. Anything else gets no mark rather than a mark that might be a lie.
+ */
+export function reviewedByNames(run: {
+  status: string;
+  crew?: readonly CrewPreset[];
+  reviews?: readonly ReviewVerdict[];
+}): string[] {
+  if (run.status !== 'done') return [];
+  const required = (run.crew ?? []).filter((p) => p.requiredForDone);
+  if (!required.length) return [];
+  const names: string[] = [];
+  for (const p of required) {
+    const passed = (run.reviews ?? []).filter((v) => v.presetId === p.id && v.pass);
+    if (!passed.length) return [];
+    names.push(p.name);
+  }
+  return names;
+}
+
+/** `$0.42` when the run's provider priced it, nothing when it did not. */
+function cost(v: ReviewVerdict): string {
+  return typeof v.costUsd === 'number' && v.costUsd > 0 ? ` · $${v.costUsd.toFixed(2)}` : '';
+}
+
+/**
+ * The `reviews:` block for a run report, or [] when the run collected none.
+ *
+ * `currentDiffHash` is optional because most surfaces cannot honestly compute
+ * it: a report reads a frozen deck whose diffs are capped, so hashing it would
+ * call a perfectly good PASS stale. Without it, staleness is simply not
+ * claimed — the end-of-run gate is the one place that judges it — and the
+ * other two blockers, a required reviewer that never ran and one that said
+ * FAIL, are facts the record already holds.
+ */
+export function reviewReportLines(
+  crew: readonly CrewPreset[] | undefined,
+  reviews: readonly ReviewVerdict[] | undefined,
+  currentDiffHash?: string,
+): string[] {
+  const verdicts = reviews ?? [];
+  if (!verdicts.length && !(crew ?? []).length) return [];
+  const lines: string[] = [];
+  if (verdicts.length) {
+    lines.push(`reviews: ${verdicts.map((v) => `${v.name} ${v.pass ? 'PASS' : 'FAIL'}${cost(v)}`).join(', ')}`);
+  }
+  const blockers = reviewBlockers(crew, verdicts, currentDiffHash ?? '')
+    .filter((b) => (currentDiffHash === undefined ? b.reason !== 'stale' : true));
+  for (const b of blockers) {
+    lines.push(b.reason === 'missing'
+      ? `  ${b.name} is required for this run to be done and has not reviewed it.`
+      : b.reason === 'fail'
+        ? `  ${b.name} is required for this run to be done and returned FAIL.`
+        : `  ${b.name} passed an earlier version of the diff; the code changed after it.`);
+  }
+  return lines;
+}

package/src/server.ts

@@ -82,6 +82,8 @@ import { reconcileRole } from './role-provider.js';
 import { detectBrowser, installChromium } from './browser.js';
 import { frozenDeck, frozenMissionDoc, parkMissionDoc, restoreMissionDoc, snapshotRun } from './snapshot.js';
 import { closeMissionBranch, compareUrl, createPullRequest, dirtyPaths, ensureMissionBranch, ghReady, gitInfo, resolvePrBase, worktreeGrant, worktreeParent, missionBranchName, prDraft, pullRequestState, pushBranch, renameMissionBranch, startMissionBranch, type GitInfo } from './gitwork.js';
+import { crewPresetsFrom, type CrewPreset } from './crew.js';
+import { frozenCrewFor, reviewReportLines, reviewedByNames } from './run-crew.js';
 import { detectTailscale, tailnetUrl } from './tailscale.js';
 import { checkForUpdate, currentVersion, type UpdateInfo } from './update.js';
 import { ServiceRegistry, listeningPid, portOpen, servicesHandler, stopService } from './services.js';
@@ -702,6 +704,101 @@ async function agentEnvFor(
   return providerEnv(resolved, ledgerKey ? `${url}/run/${encodeURIComponent(ledgerKey)}` : url);
 }
 
+/**
+ * An agent env per crew preset that named a provider of its own, keyed by
+ * preset id — the third kind of env a run can need, after its two roles. A
+ * reviewer pinned to another provider is a real request: the point of a second
+ * opinion is partly that it comes from a different model, and a model carries
+ * its provider.
+ *
+ * Only presets that name a `providerId` get an entry, and only when that
+ * provider resolves cleanly. Anything else — no id, an id nothing resolves,
+ * a resolution `providerProblem` calls unusable — is LEFT OUT rather than
+ * reported, because a missing entry means the reviewer runs on the worker env
+ * and a thrown error means the run dies. A provider deleted between the moment
+ * a human chose the crew and the moment the director asks for the review must
+ * degrade to the worker's provider: the alternative is a mission stranded at
+ * the one step that would let it be recorded as done, over a credential its
+ * reviewer never strictly needed.
+ *
+ * Each preset's env carries the preset's own model for the same reason the two
+ * roles do — the SDK's aliases have to resolve to something this provider's
+ * gateway serves — and shares the run's ledger key, since the reviewer's
+ * tokens are accounted to the worker role. See the `env` comment in
+ * orchestrator.ts's requestReviewTool for why that approximation is chosen.
+ */
+/**
+ * Each crew preset's own cost basis, by preset id — for the presets that name
+ * a provider Foreman can resolve, which are the ones that will run somewhere
+ * other than the worker role.
+ *
+ * The run needs this to count a review's spend honestly. A reviewer pinned to
+ * a paid provider beside workers on a free gateway had its dollars discarded,
+ * because cost was attributed to the worker role and a gateway role's figures
+ * are dropped by design. Whether money is real is the provider's answer, not
+ * the role's.
+ */
+async function crewBasesFor(meta: RunMeta): Promise<Record<string, { basis: CostBasis; native: boolean }> | undefined> {
+  const wanted = (meta.crew ?? []).filter((p) => p.providerId);
+  if (!wanted.length) return undefined;
+  const out: Record<string, { basis: CostBasis; native: boolean }> = {};
+  const seen = new Map<string, { basis: CostBasis; native: boolean } | null>();
+  for (const preset of wanted) {
+    const id = preset.providerId as string;
+    if (!seen.has(id)) {
+      const ref = providerForRole(meta, id);
+      const resolved = 'id' in ref && ref.id === id
+        ? await resolveProvider(ref, store.root).catch(() => null)
+        : null;
+      seen.set(id, resolved && !providerProblem(resolved)
+        ? {
+          basis: (await roleCost(withRoleModel(resolved, preset.model ?? meta.workerModel), preset.model ?? meta.workerModel)).basis,
+          // Whether the SDK's dollar figure for this preset IS the bill, or
+          // whether it is a gateway that reports through the run's ledger.
+          native: resolved.wire === 'anthropic-native',
+        }
+        : null);
+    }
+    const cost = seen.get(id);
+    if (cost) out[preset.id] = cost;
+  }
+  return Object.keys(out).length ? out : undefined;
+}
+
+async function crewEnvsFor(
+  meta: RunMeta, ledgerKey: string,
+): Promise<Record<string, ReturnType<typeof providerEnv>> | undefined> {
+  const wanted = (meta.crew ?? []).filter((p) => p.providerId);
+  if (!wanted.length) return undefined;
+  // One resolution per distinct provider, not per preset: two reviewers on the
+  // same endpoint are one credential and one gateway.
+  const bases = new Map<string, ResolvedProvider | null>();
+  const out: Record<string, ReturnType<typeof providerEnv>> = {};
+  for (const preset of wanted) {
+    const id = preset.providerId as string;
+    if (!bases.has(id)) {
+      const ref = providerForRole(meta, id);
+      // providerForRole answers with the RUN's provider when the id resolves to
+      // nothing it knows. That is the right answer for a role, which must run
+      // somewhere; here it would quietly pin the preset to a provider nobody
+      // asked for, so it counts as "no entry" instead.
+      const resolved = 'id' in ref && ref.id === id
+        ? await resolveProvider(ref, store.root).catch(() => null)
+        : null;
+      bases.set(id, resolved && !providerProblem(resolved) ? resolved : null);
+    }
+    const base = bases.get(id);
+    if (!base) continue;
+    const withModel = withRoleModel(base, preset.model ?? meta.workerModel);
+    if (providerProblem(withModel)) continue;
+    // A gateway that will not start is the same kind of nothing: the reviewer
+    // falls back rather than the run failing.
+    const env = await agentEnvFor(withModel, meta.id, ledgerKey).catch(() => null);
+    if (env) out[preset.id] = env;
+  }
+  return Object.keys(out).length ? out : undefined;
+}
+
 /**
  * The ledger bucket for this attempt at a run.
  *
@@ -1118,6 +1215,10 @@ const fleetHost: FleetHost = {
     ];
     if (words.error) lines.push(`it stopped with: ${clipText(words.error, 400)}`);
     if (last.workers.length) lines.push(`crew: ${last.workers.map((w) => `${w.id} ${w.status}`).join(', ')}`);
+    // Verdicts read out here and nowhere else on the phone: which reviewers
+    // ran is a fact about the run, while which presets exist is configuration,
+    // and configuration is edited on the dashboard.
+    lines.push(...reviewReportLines(last.crew, last.reviews));
     if (words.result) lines.push(`director's closing report:\n${clipText(words.result, 2500)}`);
     else if (words.last) lines.push(`director's last words:\n${clipText(words.last, 2500)}`);
     return lines.join('\n');
@@ -1631,8 +1732,8 @@ async function driveRun(
   let agentEnv;
   let roleBasis = resolved.costBasis;
   let prices: { director?: ModelPrice; worker?: ModelPrice } = {};
-  let roleBases: { director: CostBasis; worker: CostBasis } | undefined;
-  let gatewayRoles = { director: false, worker: false };
+  let roleBases: { director: CostBasis; worker: CostBasis; crew?: Record<string, { basis: CostBasis; native: boolean }> } | undefined;
+  let gatewayRoles: { director: boolean; worker: boolean; crew?: boolean } = { director: false, worker: false };
   try {
     // Resolved per role. Where both roles share a provider this resolves once
     // and starts one gateway; where they differ, the supervisor already runs a
@@ -1662,11 +1763,15 @@ async function driveRun(
       worker: directorProvider === workerProvider
         ? await agentEnvFor(directorProvider, meta.id, key)
         : await agentEnvFor(workerProvider, meta.id, key),
+      crew: await crewEnvsFor(meta, key),
     };
     // Only roles that actually go through a gateway are counted there; a
     // native role's tokens arrive on the SDK's own result message, and adding
     // both would double every one of them.
     gatewayRoles = {
+      // A crew preset on a gateway sends its tokens to the same ledger, so
+      // polling has to run even when both ordinary roles are native.
+      crew: Object.values(await crewBasesFor(meta) ?? {}).some((c) => !c.native),
       director: directorProvider.wire !== 'anthropic-native',
       worker: workerProvider.wire !== 'anthropic-native',
     };
@@ -1676,7 +1781,7 @@ async function driveRun(
       : await roleCost(workerProvider, meta.workerModel);
     roleBasis = combineBasis(directorCost.basis, workerCost.basis);
     prices = { director: directorCost.price, worker: workerCost.price };
-    roleBases = { director: directorCost.basis, worker: workerCost.basis };
+    roleBases = { director: directorCost.basis, worker: workerCost.basis, crew: await crewBasesFor(meta) };
   } catch (err) {
     meta.status = 'error';
     meta.endedAt = Date.now();
@@ -1799,6 +1904,8 @@ async function effectiveSettings(projectId: string): Promise<{
   budgetWarnAt: number;
   /** Ceiling on what this project's SCHEDULED runs may cost in one calendar month. */
   scheduledMonthlyCapUsd: number;
+  /** The crew presets a mission here may be started with (built-ins until edited). */
+  crewPresets: CrewPreset[];
 }> {
   const s = await store.readSettings()
     .catch(() => ({ global: {}, projects: {} as Record<string, object> }));
@@ -1831,6 +1938,9 @@ async function effectiveSettings(projectId: string): Promise<{
       const raw = Number(p.scheduledMonthlyCapUsd ?? g.scheduledMonthlyCapUsd);
       return Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_SCHEDULED_MONTHLY_CAP_USD;
     })(),
+    // The project's list replaces the global one whole, like the rest of the
+    // overlay — merging would make "no reviewer on this project" unsayable.
+    crewPresets: crewPresetsFrom(g, p),
   };
 }
 
@@ -1912,6 +2022,12 @@ async function startRun(
     scheduleId?: string;
     scheduleName?: string;
   } = {},
+  /**
+   * Crew presets the human opted this mission into, by id. Resolved and copied
+   * onto the record here and nowhere else: the run is reviewed against the
+   * presets as they stood when it started, whatever Settings says later.
+   */
+  crewIds?: readonly string[],
 ): Promise<void> {
   const settings = await effectiveSettings(projectId);
   if (origin.scheduleId && origin.scheduleName) scheduleNames.set(origin.scheduleId, origin.scheduleName);
@@ -1937,6 +2053,13 @@ async function startRun(
     // must not silently move an in-flight or resumed run to another provider,
     // or another bill.
     provider,
+    // Frozen for the same reason as the provider, and against a stronger
+    // temptation: a preset edited next week must not change what a run that is
+    // still going — or one that finished in March — was reviewed against.
+    ...(() => {
+      const crew = frozenCrewFor(settings.crewPresets, crewIds);
+      return crew ? { crew } : {};
+    })(),
     status: 'running', costUsd: 0,
     createdAt: Date.now(), workers: [],
   };
@@ -2531,6 +2654,10 @@ const server = http.createServer(async (req, res) => {
             createdAt: lastRun.createdAt, costUsd: lastRun.costUsd,
             // The card may print a dollar only where the dollar was real.
             costBasis: costBasisOf(lastRun), usage: lastRun.usage,
+            // Not the verdicts themselves — see reviewedByNames. The tile
+            // renders a glyph and a name, and this projection is polled for
+            // every project every few seconds.
+            reviewedBy: reviewedByNames(lastRun),
           },
           // When this project last did anything, so the fleet can lead with it.
           // A planner parked on a question is doing something — waiting on
@@ -2680,7 +2807,7 @@ const server = http.createServer(async (req, res) => {
     } else if (req.method === 'POST' && url.pathname === '/run') {
       const {
         projectId, mission, budgetUsd, directorModel, workerModel, browserTools,
-        directorProviderId, workerProviderId, allowDirty, startedBy,
+        directorProviderId, workerProviderId, allowDirty, startedBy, crew,
       } = await readBody(req);
       if (typeof projectId !== 'string' || typeof mission !== 'string' || !mission.trim()) {
         return json(res, 400, { error: 'projectId and mission are required' });
@@ -2726,7 +2853,10 @@ const server = http.createServer(async (req, res) => {
         // 'schedule' is deliberately not accepted here: a caller must not be
         // able to forge a scheduled start and charge the month's unattended
         // allowance for a run no schedule asked for.
-        { startedBy: startedBy === 'phone' || startedBy === 'mcp' ? startedBy : 'human' });
+        { startedBy: startedBy === 'phone' || startedBy === 'mcp' ? startedBy : 'human' },
+        // The composer is the only place a crew is chosen, so it is the only
+        // dispatch path that carries one; unknown ids are dropped downstream.
+        Array.isArray(crew) ? crew as string[] : undefined);
       json(res, 200, { ok: true });
 
     } else if (url.pathname === '/notify' && req.method === 'GET') {
@@ -3195,7 +3325,7 @@ const server = http.createServer(async (req, res) => {
       // mission was branched from — see resolvePrBase.
       const target = await resolvePrBase(meta.folder, meta.git.base);
       json(res, 200, {
-        ...prDraft(meta, doc), branch: meta.git.branch, base: target.base, commits: meta.git.commits ?? null,
+        ...prDraft(meta, doc, meta.reviews), branch: meta.git.branch, base: target.base, commits: meta.git.commits ?? null,
         branchedFrom: meta.git.base, baseFellBack: target.fellBack,
         remote: info.remote, compareUrl: compareUrl(info.remote, target.base, meta.git.branch),
         gh, pr: meta.git.pr ?? null, onBranch: info.branch === meta.git.branch, dirty: Boolean(info.dirty),

package/src/types.ts

@@ -6,11 +6,17 @@
  * so replaying a log reproduces exactly what a live client observed.
  */
 import type { Cadence } from './schedule.js';
+import type { CrewPreset, ReviewVerdict } from './crew.js';
 
 /** Re-exported so callers can name a schedule's cadence without reaching past
  *  this module for it; the rules that interpret one live in schedule.ts. */
 export type { Cadence };
 
+/** Re-exported on the same principle: a record can be described without
+ *  reaching past this module, while crew.ts stays the definition site and
+ *  keeps the rules that read them. */
+export type { CrewPreset, ReviewVerdict };
+
 export type RunStatus = 'running' | 'done' | 'error' | 'interrupted';
 
 /** A linked project — a folder Foreman runs missions in. */
@@ -249,6 +255,14 @@ export interface WorkerMeta {
   status: WorkerStatus;
   costUsd: number;
   sessionId?: string;
+  /**
+   * The crew preset this worker IS, when it is a reviewer rather than an
+   * ordinary worker. Persisted — unlike the launch overrides, which hold a
+   * live credential — so a resumed run can rebuild the read-only policy, the
+   * model and the provider from the frozen crew instead of resuming a
+   * reviewer as a worker that may write.
+   */
+  crewPresetId?: string;
   /** First 500 chars of the task brief, for run-history display. */
   task: string;
   /**
@@ -353,6 +367,19 @@ export interface RunMeta {
   provider?: ProviderRef;
   /** @deprecated Pre-provider pin, still read for runs recorded before providers. */
   claudeInstance?: ClaudeInstanceRef;
+  /**
+   * Crew presets frozen onto the run at dispatch: a later edit of a preset
+   * must not change a running or past run. Absent means the run was dispatched
+   * with no crew chosen — which is every run recorded before presets existed,
+   * and the reason the gate reads an absent field as "nothing required".
+   */
+  crew?: CrewPreset[];
+  /**
+   * Review verdicts this run collected, appended in order. Kept whole rather
+   * than reduced to a pass/fail: the gate needs the diff each verdict was
+   * about, and the human reading the record afterwards needs the findings.
+   */
+  reviews?: ReviewVerdict[];
   /** Number of times this run was resumed after an interruption. */
   resumes?: number;
   /**
@@ -526,6 +553,8 @@ export interface MissionProposal {
   directorProviderId?: string;
   workerProviderId?: string;
   modelRationale?: string;
+  /** Preset ids the planner may suggest; the human's toggles decide. */
+  crew?: string[];
   createdAt: number;
 }