@aragon-agent/cli 0.6.22 → 0.6.24

package/dist/team/model.js

@@ -0,0 +1,136 @@
+/**
+ * `resolveSubagentModel` — THE single authority on which model a team child
+ * runs (subagent-model-and-question-controls §3.3).
+ *
+ * ASCII ONLY: `src/team/**` is inside the glyph scanner's scope.
+ *
+ * EVERY CONSUMER READS THE CHILD'S MODEL THROUGH THIS FUNCTION AND NOWHERE
+ * ELSE — `createSubagent`, the `task` report header, the settings root row and
+ * `/team model` — following the `resolveFastTier` precedent one directory over:
+ * four call sites each recomputing "which model do children run on?" from raw
+ * config keys is exactly how the report ends up naming a model the children
+ * silently fell back from.
+ *
+ * IT IS RE-RUN ON EVERY DISPATCH AND EVERY RENDER, NOT ONCE (rule 8 / RV-3 of
+ * the fast tier, inherited here): `team.model`, the fast tier and the profile
+ * library are all LIVE keys a settings save, `/fast off` or `/team model` can
+ * rewrite mid-session. A resolution captured at construction would be a
+ * resolution describing a session that no longer exists.
+ *
+ * A CHILD IS NEVER LEFT WITHOUT A MODEL (D-4). Every failure mode — fast tier
+ * off, profile deleted, profile key missing — degrades to the MAIN connection
+ * with a `fallbackReason`, so a dispatch cannot fail because its model setting
+ * went stale. The reason is disclosed, never swallowed: the report header and
+ * the settings summary line both render it.
+ */
+import { resolveFastTier } from '../fast/resolve.js';
+function mainRef(config) {
+    return {
+        providerId: config.provider,
+        modelId: config.model,
+        ...(config.baseUrl ? { baseUrl: config.baseUrl } : {}),
+    };
+}
+function fallbackToMain(config, mode, fallbackReason) {
+    // THE ALWAYS-USABLE ANSWER (D-4): whatever the user asked for that could not
+    // resolve, the caller still gets a working connection — the same provider,
+    // model, base URL and thinking level the lead itself runs on.
+    return {
+        mode,
+        effective: 'main',
+        ref: mainRef(config),
+        thinkingLevel: config.thinkingLevel,
+        keyRole: 'main',
+        profile: null,
+        fallbackReason,
+    };
+}
+/**
+ * Resolve the model every child of the NEXT dispatch will run on.
+ *
+ * Pure, synchronous, no IO — testable as a matrix over config fixtures.
+ *
+ * @param config The live effective config. Read fresh; never snapshot it.
+ * @param hasKey `AgentController.hasApiKey`, which already resolves the
+ *   config-file key, the provider environment variable and the one-shot
+ *   `--api-key` override. Injected rather than reimplemented for the reason
+ *   `resolveFastTier` records: a second key resolver is a second answer to
+ *   "why does it say no key?".
+ */
+export function resolveSubagentModel(config, hasKey) {
+    // `clampTeamConfig` guarantees the enum on every read and write path, so the
+    // default `'main'` here is belt-and-braces rather than a real branch.
+    const mode = config.team.model ?? 'main';
+    if (mode === 'fast') {
+        const tier = resolveFastTier(config, hasKey);
+        if (tier.ok) {
+            return {
+                mode,
+                effective: 'fast',
+                ref: tier.ref,
+                thinkingLevel: config.fast.thinkingLevel,
+                keyRole: 'fast',
+                profile: null,
+            };
+        }
+        return fallbackToMain(config, mode, 'fast_unavailable');
+    }
+    if (mode === 'profile') {
+        // A missing library, a missing id and a dangling id are one outcome
+        // (D-4): degrade to main and say so. Reference EXISTENCE is deliberately
+        // not validated in `clampTeamConfig` — resolution is where it belongs.
+        const id = config.team.modelProfileId;
+        const entry = id
+            ? config.modelProfiles?.entries.find((candidate) => candidate.id === id)
+            : undefined;
+        if (!entry)
+            return fallbackToMain(config, mode, 'profile_missing');
+        // The dedicated entry key wins; without one the shared layer must have a
+        // key for the entry's provider, or the child could not authenticate at all.
+        if (!entry.apiKey && !hasKey(entry.provider, 'main')) {
+            return fallbackToMain(config, mode, 'profile_no_key');
+        }
+        return {
+            mode,
+            effective: 'profile',
+            ref: {
+                providerId: entry.provider,
+                modelId: entry.model,
+                ...(entry.baseUrl ? { baseUrl: entry.baseUrl } : {}),
+            },
+            thinkingLevel: config.thinkingLevel,
+            keyRole: 'main',
+            profile: entry,
+        };
+    }
+    return {
+        mode: 'main',
+        effective: 'main',
+        ref: mainRef(config),
+        thinkingLevel: config.thinkingLevel,
+        keyRole: 'main',
+        profile: null,
+    };
+}
+/**
+ * The key a CHILD resolves for a provider, profile-aware (§3.3 / I-4).
+ *
+ * A profile's dedicated key is visible ONLY here: it never reaches env,
+ * `config.apiKeys` or a log line. While the resolution's profile is bound and
+ * the provider matches it, the entry key takes priority over the shared layer;
+ * every other provider (and every non-profile mode) resolves through the
+ * lead's own resolver at `resolution.keyRole` — which is what keeps a `fast`
+ * child entitled to the fast-role key and a `main` child to the main one.
+ *
+ * @param config The live config (carried for parity with the resolver pair).
+ * @param resolution A fresh `resolveSubagentModel` output.
+ * @param providerId The provider the child needs a key for.
+ * @param shared The lead-layer resolver (`controller.resolveKey`).
+ */
+export function resolveSubagentKey(config, resolution, providerId, shared) {
+    void config; // parity parameter: the pair reads one config, the key does not need it
+    if (resolution.profile && providerId === resolution.ref.providerId) {
+        return resolution.profile.apiKey ?? shared(providerId, 'main');
+    }
+    return shared(providerId, resolution.keyRole);
+}

package/dist/team/overseer.d.ts

@@ -49,8 +49,10 @@ import type { OverseerAction, OverseerDecision, SubagentRun, SubagentSpec } from
  * Bumped whenever either supervisor protocol prompt changes (D-9), so a
  * behaviour report can be tied to a prompt revision with one grep.
  * `TEAM_BLOCK_VERSION` covers only the LEAD's `<team>` block, not these.
+ *
+ * v3 adds the turn-cap trigger to the single-inspection prompt (F-8 A'2).
  */
-export declare const OVERSEER_PROMPT_VERSION = "v2-2026-10";
+export declare const OVERSEER_PROMPT_VERSION = "v3-2026-10";
 /** One remembered decision, so the second look knows the first happened. */
 export interface OverseerMemoryEntry {
     /** Seconds into the dispatch. */
@@ -63,7 +65,7 @@ export interface ChildDigestInput {
     run: SubagentRun;
     /** False only in the post-mortem inspection, after the child settled. */
     childAlive: boolean;
-    trigger: 'silence' | 'clock' | 'postmortem';
+    trigger: 'silence' | 'clock' | 'turncap' | 'postmortem';
     /** The child's LIVE history (`SubagentAgentLike.state.messages`). */
     messages: readonly Message[];
     memory: readonly OverseerMemoryEntry[];
@@ -203,7 +205,7 @@ export declare function createFastOverseerProvider(deps: FastOverseerDeps): Over
 export interface OverseerInspectRequest {
     run: SubagentRun;
     messages: readonly Message[];
-    trigger: 'silence' | 'clock' | 'postmortem';
+    trigger: 'silence' | 'clock' | 'turncap' | 'postmortem';
     childAlive: boolean;
 }
 export interface TeamOverseerOptions {

package/dist/team/overseer.js

@@ -50,8 +50,10 @@ import { TEAM_LIMITS } from './limits.js';
  * Bumped whenever either supervisor protocol prompt changes (D-9), so a
  * behaviour report can be tied to a prompt revision with one grep.
  * `TEAM_BLOCK_VERSION` covers only the LEAD's `<team>` block, not these.
+ *
+ * v3 adds the turn-cap trigger to the single-inspection prompt (F-8 A'2).
  */
-export const OVERSEER_PROMPT_VERSION = 'v2-2026-10';
+export const OVERSEER_PROMPT_VERSION = 'v3-2026-10';
 /** How many trailing history messages the digest carries. */
 const DIGEST_TAIL_MESSAGES = 8;
 /** Per-message text clamp inside the digest. */
@@ -78,6 +80,13 @@ function messageText(message) {
 function clampChars(text, max) {
     return text.length <= max ? text : `${text.slice(0, Math.max(0, max - 3))}...`;
 }
+/** One line per trigger, as the digest names it (a union VALUE, never prose). */
+const TRIGGER_LABELS = {
+    silence: 'event silence (suspected stall)',
+    clock: 'wall-clock check',
+    turncap: 'turn cap reached (inspection trigger, not a stop)',
+    postmortem: 'post-mortem (child already ended)',
+};
 /**
  * Build the bounded text one inspection reads.
  *
@@ -91,7 +100,7 @@ export function buildChildDigest(input) {
     const { run, childAlive, trigger, messages, memory, elapsedSec } = input;
     const lines = [];
     lines.push(`child: ${run.label} "${run.description}"`);
-    lines.push(`trigger: ${trigger === 'silence' ? 'event silence (suspected stall)' : trigger === 'clock' ? 'wall-clock check' : 'post-mortem (child already ended)'}`);
+    lines.push(`trigger: ${TRIGGER_LABELS[trigger]}`);
     lines.push(`elapsed: ${Math.round(elapsedSec)}s, alive: ${childAlive ? 'yes' : 'no'}`);
     lines.push(`phase: ${run.phase}, turns: ${run.turns}, toolCalls: ${run.toolCalls}` +
         (run.lastTool ? `, lastTool: ${run.lastTool}` : ''));
@@ -270,8 +279,10 @@ export function parseOverseerBatchText(text) {
 }
 const OVERSEER_SYSTEM_PROMPT = [
     'You are the supervisor of a team of subagents. You are shown ONE subagent',
-    'that crossed a time trigger (event silence or a wall-clock check) and must',
-    'decide what to do with it. Answer with ONE JSON object and nothing else:',
+    'that crossed a supervision trigger (event silence, a wall-clock check, or',
+    'the configured turn cap) and must decide what to do with it. Crossing a',
+    'ceiling does NOT stop the child - your decision does. Answer with ONE JSON',
+    'object and nothing else:',
     '{"action": "wait" | "nudge" | "replace" | "abandon", "reason": "<= 200 chars",',
     ' "guidance": "<= 1200 chars, nudge only", "nextCheckMs": <ms, wait only>}.',
     'wait: the child looks healthy or is legitimately blocked (API backoff,',

package/dist/team/report.d.ts

@@ -21,6 +21,7 @@
  * because of one HTTP 429.
  */
 import type { ModelCost } from '@aragon-agent/core';
+import type { SubagentModelResolution } from './model.js';
 import type { DispatchOutcome, SubagentRun } from './types.js';
 export interface ReportOptions {
     /** The lead's model cost table, so the header can state real spend (R-5).
@@ -37,6 +38,16 @@ export interface ReportOptions {
      * rule the fast tier already follows everywhere else).
      */
     fastCost?: ModelCost;
+    /**
+     * The dispatch-time subagent model resolution (subagent-model §3.4).
+     *
+     * ABSENT under the default `team.model: 'main'` mode is what keeps the
+     * parity report byte-identical (I-2): the disclosure line exists only when
+     * children did NOT run the main model, and a resolution that degraded
+     * (fast tier off, profile deleted, profile key missing) says so instead of
+     * silently renaming the model the children fell back to (D-4).
+     */
+    subagentModel?: SubagentModelResolution;
 }
 /**
  * Cut `text` to at most `maxBytes` WITHOUT splitting a UTF-8 sequence.

package/dist/team/report.js

@@ -106,8 +106,31 @@ function buildHeader(outcome, options) {
             `(${counts}) in ${formatDuration(durationMs)}.`
         : `Team dispatch: ${outcome.runs.length} of ${outcome.runs.length} subagents finished ` +
             `(${counts}) in ${formatDuration(durationMs)}.`);
+    // THE PRICE OF THE MODEL CHILDREN ACTUALLY RAN (subagent-model §3.4). The
+    // default main flow always supplies a table, so the ternary's last branch
+    // is the legacy byte-identical shape; an UNPRICED fast or profile child
+    // model says `pricing unknown` - unknown pricing is not zero pricing, and
+    // `$0.00` on a dispatch that is spending money is the C-11 / RV-4 lie.
+    const spend = options.cost
+        ? formatCost(computeCost(outcome.usage, options.cost))
+        : options.subagentModel && options.subagentModel.effective !== 'main'
+            ? 'pricing unknown'
+            : formatCost(computeCost(outcome.usage, options.cost));
     lines.push(`Tokens: in ${formatTokens(outcome.usage.inputTokens)}, out ` +
-        `${formatTokens(outcome.usage.outputTokens)}. Cost: ${formatCost(computeCost(outcome.usage, options.cost))}.`);
+        `${formatTokens(outcome.usage.outputTokens)}. Cost: ${spend}.`);
+    // THE MODEL DISCLOSURE LINE (D-4), immediately after the spend it explains.
+    // Rendered only when children did not run the main model, so the default
+    // report stays byte-identical (I-2) and a degraded request says WHICH mode
+    // was asked for and WHY it fell back rather than quietly renaming it.
+    const subagent = options.subagentModel;
+    if (subagent && subagent.effective !== 'main') {
+        lines.push(`Children ran on ${subagent.ref.providerId}:${subagent.ref.modelId} ` +
+            `(subagent model: ${subagent.effective}).`);
+    }
+    else if (subagent && subagent.fallbackReason) {
+        lines.push(`Subagent model ${subagent.mode} unavailable (${subagent.fallbackReason}); ` +
+            `children ran on the main model.`);
+    }
     for (const conflict of findFileConflicts(outcome.runs)) {
         const who = conflict.labels.map((l) => `"${l}"`).join(' and ');
         lines.push(`WARNING: agents ${who} both wrote ${conflict.path} - review before trusting either.`);

package/dist/team/runtime.js

@@ -488,6 +488,18 @@ export class TeamRuntime {
             // ONE KICK PER REAL AGENT EVENT, unthrottled (I-OV3): the silence
             // window resets on evidence, not on a coalesced UI frame.
             onActivity: () => this.supervision?.kick(spec.label),
+            // A'2: under supervision the turn cap is ONE inspection, fired from the
+            // child's own `turn_end` at the crossing turn. Async-and-forgotten
+            // exactly like the silence timer's `onFire`: nothing in the child's
+            // event path may block or throw. ABSENT in the legacy regime, which
+            // keeps the hard stop - the hook's presence IS the gate.
+            ...(this.overseer !== null
+                ? {
+                    onTurnCapReached: (label) => {
+                        void this.inspectAndApply(dispatchId, label, 'turncap');
+                    },
+                }
+                : {}),
         });
         // ASSIGNMENT, not a declaration: a `const` here would shadow the `let` above
         // the bus, `canSend` would see the empty array forever, and every peer would
@@ -520,10 +532,15 @@ export class TeamRuntime {
         // its slowest child and only an Esc ends it early. The lead's idle
         // watchdog is paused for the whole dispatch either way, exactly as it is
         // for the lead's own long turns.
+        //
+        // D-4, NOW FOR THE WHOLE DISPATCH TOO: with the supervisor gate open the
+        // ceiling NEVER arms a hard abort - the cadence ladder is what looks at a
+        // long dispatch, exactly as it already looks at a long child. The legacy
+        // hard `abortAll()` exists ONLY under `team.overseer: false`, the same
+        // regime line `runCtx.subagentTimeoutMs` below draws.
+        const dispatchCeilingMs = team.overseer ? 0 : team.dispatchTimeoutMs;
         this.dispatchTimer =
-            team.dispatchTimeoutMs > 0
-                ? setTimeout(() => this.abortAll(), team.dispatchTimeoutMs)
-                : null;
+            dispatchCeilingMs > 0 ? setTimeout(() => this.abortAll(), dispatchCeilingMs) : null;
         const runCtx = {
             dispatchId,
             handles,

package/dist/team/subagent.d.ts

@@ -135,6 +135,16 @@ export interface SubagentHooks {
      * so the phase read at fire time is current.
      */
     onActivity?: () => void;
+    /**
+     * THE TURN CAP AS AN INSPECTION TRIGGER (F-8 A'2). Called ONCE, at the turn
+     * that crossed `maxTurnsPerSubagent`, ONLY when the dispatch supervisor is
+     * live - the runtime wires this hook under the same gate as
+     * `overseerActive`, so its presence IS the supervised/legacy branch. The
+     * child is NOT stopped: the supervisor decides wait / nudge / replace /
+     * abandon through the same `inspectAndApply` path every other trigger
+     * uses, and a child it lets run carries no `truncated` flag.
+     */
+    onTurnCapReached?: (label: string) => void;
 }
 export interface SubagentHandle {
     spec: SubagentSpec;

package/dist/team/subagent.js

@@ -18,6 +18,7 @@ import { createBuiltinTools } from '../tools/index.js';
 import { pickActivityArgs, sanitizeActivity } from './activity.js';
 import { TEAM_LIMITS, TEAM_SUBAGENT_TOOL_NAMES } from './limits.js';
 import { isRetryableStreamError } from './retry.js';
+import { resolveSubagentKey, resolveSubagentModel } from './model.js';
 import { makeTeamSend, makeTeamWait, withMailboxTail } from './comm-tools.js';
 import { buildSubagentBlock } from './prompt.js';
 /** The default factory: a real `Agent` from `@aragon-agent/core`. */
@@ -162,25 +163,34 @@ export function createSubagent(spec, deps, hooks) {
     let agentRef = null;
     const getAgent = () => agentRef;
     const tools = buildSubagentTools(spec, deps, getAgent);
-    // THE CHILD'S MODEL IS THE LEAD'S MODEL, READ FROM THE DISPATCH-TIME CONFIG
-    // (main-agent parity). Same provider, same model id, same base URL, same
-    // thinking level: a delegation is never a downgrade, and the only model a
-    // child may surprise its lead with is one a settings-screen edit made live
-    // between two dispatches.
+    // WHICH MODEL A CHILD RUNS IS A USER SETTING, RESOLVED FROM THE
+    // DISPATCH-TIME CONFIG through the one authority (subagent-model §3.4).
+    // `team.model: 'main'` - the default - is the historical main-agent parity
+    // exactly: same provider, model, base URL and thinking level as the lead.
+    // `'fast'` / `'profile'` are the user's explicit, visible, reversible cost
+    // switches, and EVERY failure mode (tier off, profile deleted, profile key
+    // missing) degrades back to the main connection with a disclosed reason
+    // rather than failing the dispatch (D-4). The MODEL itself still cannot
+    // choose: `normalizeSubagentSpecs` drops a stale `model` key (D-1).
     //
     // `maxTokens` inherits `deps.config.maxTokens` below - the same ambition the
-    // lead sends, clamped by the same adapter, so an inherited large value
-    // degrades to the right number rather than to an HTTP 400.
-    const resolved = {
-        ref: {
-            providerId: deps.config.provider,
-            modelId: deps.config.model,
-            ...(deps.config.baseUrl ? { baseUrl: deps.config.baseUrl } : {}),
-        },
-        thinkingLevel: deps.config.thinkingLevel,
-        role: 'main',
-    };
-    const model = resolved.ref;
+    // lead sends, clamped by Core's `resolveOutputTokens` against the CHILD
+    // model's own ceiling, so an inherited large value degrades to the right
+    // number rather than to an HTTP 400.
+    const resolution = resolveSubagentModel(deps.config, (id, role) => Boolean(deps.getApiKey(id, role)));
+    const model = resolution.ref;
+    // THE CHILD'S OWN KEY CLOSURE, PROFILE-AWARE (§3.3 / I-4). A bound profile's
+    // dedicated key is visible ONLY inside this closure - never in env, config
+    // `apiKeys` or a log line - while every other provider resolves through the
+    // lead's resolver at `resolution.keyRole`, which is what keeps a fast child
+    // entitled to the fast-role key and a main child to the main one.
+    const childGetApiKey = (id) => resolveSubagentKey(deps.config, resolution, id, (providerId, role) => deps.getApiKey(providerId, role));
+    // The boolean twin, for the child's compaction summarizer (V-4): the child's
+    // own resolution first, the lead layer by role second. Forwarding only
+    // `deps.getApiKey` would hide a profile-dedicated key from `resolveSummarizer`
+    // and silently disable the child's compaction - the exact gap the req-level
+    // resolvers on `ChildContextManagerRequest` exist to close.
+    const childHasKey = (id, role) => Boolean(childGetApiKey(id) ?? deps.getApiKey(id, role));
     // HOISTED TO A LOCAL, AND THAT IS WHAT MAKES W3 POSSIBLE AT ALL. This was built
     // INLINE inside the `agentFactory({...})` argument, so there was nothing for the
     // child manager's `getSystemPrompt` accessor to close over - and the accessor
@@ -216,7 +226,12 @@ export function createSubagent(spec, deps, hooks) {
     const contextManager = deps.contextManagerFor?.({
         label: spec.label,
         model,
-        role: resolved.role ?? 'main',
+        // keyRole (V-4): a fast child's summarizer resolves its main choice with
+        // role='fast', so a fast-only key is visible to it; profile keys reach it
+        // through the req-level resolvers below instead.
+        role: resolution.keyRole,
+        getApiKey: childGetApiKey,
+        hasKey: childHasKey,
         getMessages: () => agentRef?.state.messages ?? [],
         getSystemPrompt: () => systemPrompt,
         onCompacted: () => {
@@ -227,12 +242,13 @@ export function createSubagent(spec, deps, hooks) {
         systemPrompt,
         model,
         tools,
-        thinkingLevel: resolved.thinkingLevel,
+        thinkingLevel: resolution.thinkingLevel,
         // The LEAD's registry instance, REUSED (P2-2). It holds adapter state, and
         // constructing five of them per dispatch is pure waste.
         providerRegistry: deps.providerRegistry,
-        // The lead's closure, so a settings-screen key edit reaches children too.
-        getApiKey: (id) => deps.getApiKey(id, resolved.role ?? 'main'),
+        // The child's own profile-aware closure, so a settings-screen key edit
+        // reaches children too and a bound profile's key reaches ONLY them.
+        getApiKey: childGetApiKey,
         ...(deps.config.maxTokens !== undefined ? { maxTokens: deps.config.maxTokens } : {}),
         timeouts: {
             toolTimeout: deps.config.toolTimeoutMs,
@@ -359,12 +375,26 @@ export function createSubagent(spec, deps, hooks) {
                 // not runaway - it is working.
                 const turnCap = deps.config.team.maxTurnsPerSubagent;
                 if (turnCap > 0 && run.turns >= turnCap) {
-                    run.truncated = true;
-                    // THE FLAG FIRST, exactly like `handle.abort()`: the child's
-                    // reviewer reads `abortRequested` as its guard-1 fact, and a
-                    // turn-cap stop must be visible to it in the same tick.
-                    abortRequested = true;
-                    agent.abort();
+                    if (hooks.onTurnCapReached !== undefined) {
+                        // A'2, D-4 for the turn cap: SUPERVISED means the ceiling is
+                        // an inspection trigger, not a death sentence. ONE look at the
+                        // crossing turn (`===`), never a per-turn storm; the child
+                        // keeps working unless the supervisor decides replace or
+                        // abandon, and a child that keeps running carries NO
+                        // `truncated` flag - the report must not call it partial.
+                        if (run.turns === turnCap)
+                            hooks.onTurnCapReached(spec.label);
+                    }
+                    else {
+                        // LEGACY regime (no supervisor for this dispatch): the hard
+                        // stop, byte for byte what it always was.
+                        run.truncated = true;
+                        // THE FLAG FIRST, exactly like `handle.abort()`: the child's
+                        // reviewer reads `abortRequested` as its guard-1 fact, and a
+                        // turn-cap stop must be visible to it in the same tick.
+                        abortRequested = true;
+                        agent.abort();
+                    }
                 }
                 break;
             }

package/dist/team/task-tool.d.ts

@@ -20,14 +20,17 @@
  * in the schema would behave differently depending on whether `ajv`, an OPTIONAL
  * dependency of core, happened to install.
  *
- * EVERY CHILD RUNS THE LEAD'S OWN MODEL (main-agent parity): same provider,
- * model, thinking level and token ambition, resolved from the LIVE config at
- * dispatch. There is no per-child `model` property and no cheap tier to pick -
- * a delegation is never a downgrade, and the fast tier reaches children the
- * same way it reaches the lead (compaction summaries, per-child reviews).
+ * WHICH MODEL A CHILD RUNS IS THE USER'S SETTING, NOT THE MODEL'S (D-1):
+ * `team.model` defaults to the lead's own connection (main-agent parity) and
+ * can name the fast tier or a profile; there is still no per-child `model`
+ * property, so a delegation is never a self-downgrade. Resolution lives in
+ * `team/model.ts` and is re-read from the LIVE config at every dispatch; the
+ * fast tier otherwise reaches children the way it reaches the lead
+ * (compaction summaries, per-child reviews).
  */
 import { type AgentTool } from '@aragon-agent/core';
 import type { ModelCost } from '@aragon-agent/core';
+import type { SubagentModelResolution } from './model.js';
 import type { TeamRuntime } from './runtime.js';
 export interface TaskToolDeps {
     runtime: TeamRuntime;
@@ -37,8 +40,24 @@ export interface TaskToolDeps {
     /** Whether a usable key exists for the active provider right now (P2-3). */
     hasApiKey: () => boolean;
     activeProvider: () => string;
-    /** The lead's cost table, so the report header states real spend (R-5). */
+    /**
+     * The cost table of the model children ACTUALLY run (subagent-model §3.4).
+     *
+     * The controller resolves `team.model` live and prices `modelCost` at the
+     * EFFECTIVE model's table: with the default `main` mode this is exactly the
+     * lead's own table, so the report's spend line is byte-identical to the
+     * parity behavior; with `fast` / `profile` it is that model's table, and an
+     * UNPRICED one yields `undefined` so the header says `pricing unknown`
+     * rather than fabricating `$0.00` (C-11 / RV-4).
+     */
     modelCost: () => ModelCost | undefined;
+    /**
+     * The dispatch-time subagent model resolution, for the report's disclosure
+     * line (D-4): rendered ONLY when children did not run the main model, and
+     * carrying the fallback reason when they could not. OPTIONAL so existing
+     * construction sites compile; absent simply omits the line.
+     */
+    subagentModel?: () => SubagentModelResolution;
     /**
      * The FAST tier's cost table, so the report's supervisor spend line states
      * real spend (subagent-overseer-v2 D-7 / R-P1-2). OPTIONAL and returning

package/dist/team/task-tool.js

@@ -20,11 +20,13 @@
  * in the schema would behave differently depending on whether `ajv`, an OPTIONAL
  * dependency of core, happened to install.
  *
- * EVERY CHILD RUNS THE LEAD'S OWN MODEL (main-agent parity): same provider,
- * model, thinking level and token ambition, resolved from the LIVE config at
- * dispatch. There is no per-child `model` property and no cheap tier to pick -
- * a delegation is never a downgrade, and the fast tier reaches children the
- * same way it reaches the lead (compaction summaries, per-child reviews).
+ * WHICH MODEL A CHILD RUNS IS THE USER'S SETTING, NOT THE MODEL'S (D-1):
+ * `team.model` defaults to the lead's own connection (main-agent parity) and
+ * can name the fast tier or a profile; there is still no per-child `model`
+ * property, so a delegation is never a self-downgrade. Resolution lives in
+ * `team/model.ts` and is re-read from the LIVE config at every dispatch; the
+ * fast tier otherwise reaches children the way it reaches the lead
+ * (compaction summaries, per-child reviews).
  */
 import { errorResult, textResult } from '@aragon-agent/core';
 import { TEAM_LIMITS } from './limits.js';
@@ -39,8 +41,9 @@ const TEAM_OFF_REFUSAL = 'Team mode is off for this session. Do this work yourse
  */
 const TASK_DESCRIPTION = 'Run several independent subagents in parallel and get one combined report. Each ' +
     'subagent is a fresh agent with the same tools and working directory but NO memory of ' +
-    'this conversation - its prompt must be self-contained. Each runs on the same model ' +
-    'you are running on. Use this when a task splits ' +
+    'this conversation - its prompt must be self-contained. Each runs on the model the ' +
+    'user configured for subagents (the main model by default). Use this when a task ' +
+    'splits ' +
     'into 2 or more parts that do not depend on each other\'s output, especially reading or ' +
     'searching several areas at once. Do NOT use it when one part needs another part\'s ' +
     'result (do those yourself, in order), when two parts would edit the same file, or for ' +
@@ -120,13 +123,16 @@ export function createTaskTool(deps) {
             //    A cancellation or a partial result rendered as a tool FAILURE invites
             //    the model to retry the whole fan-out, which is the most expensive
             //    possible reaction (the same reasoning as `ask_user`'s cancelled
-            //    shape, and D-14 one level up). Every child ran the lead's own model,
-            //    so the lead's cost table is the one honest price for the total.
+            //    shape, and D-14 one level up). `modelCost` is priced at the model
+            //    children ACTUALLY ran - the lead's own table under the default
+            //    `main` mode - so the total stays one honest price.
             const cost = deps.modelCost();
             const fastCost = deps.fastModelCost?.();
+            const subagentModel = deps.subagentModel?.();
             return textResult(buildDispatchReport(outcome, {
                 ...(cost ? { cost } : {}),
                 ...(fastCost ? { fastCost } : {}),
+                ...(subagentModel ? { subagentModel } : {}),
             }));
         },
     };

package/dist/team/types.d.ts

@@ -201,13 +201,14 @@ export interface OverseerIntervention {
     action: OverseerAction;
     reason: string;
     /**
-     * What the trigger was: event stall, wall-clock check, post-mortem, or
-     * the supervisor going QUIET (subagent-overseer-v2 D-10) - the look
+     * What the trigger was: event stall, wall-clock check, the child's turn
+     * cap (F-8 A'2 - an inspection the supervisor then ruled on), post-mortem,
+     * or the supervisor going QUIET (subagent-overseer-v2 D-10) - the look
      * budget ran out and supervision stopped waking this child. A VALUE OF
      * THE UNION, never a reason prefix: a human-readable sentence is not a
      * machine contract (the `run.error` rule).
      */
-    trigger: 'silence' | 'clock' | 'postmortem' | 'quiet';
+    trigger: 'silence' | 'clock' | 'turncap' | 'postmortem' | 'quiet';
 }
 /**
  * A terminal supervisor decision handed to the WORKER LOOP, which is the only

package/dist/ui/App.js

@@ -2144,6 +2144,11 @@ export function App({ controller, version, initialOverlay, initialPrompt, confir
             // `auto`, not an empty string: an empty field reads as "unset", which
             // is indistinguishable from AUTO and is not a state this can be in.
             maxTokens: cfg.maxTokens ? String(cfg.maxTokens) : 'auto',
+            // BOTH HALVES, seeded AND read back (§6.3): the sibling comment above
+            // records what omitting either one costs. `auto` mirrors the row's
+            // empty-field reading; a bound Main profile hides the row entirely
+            // and the profile editor seeds from the entry instead.
+            contextWindow: cfg.contextWindow === null ? 'auto' : String(cfg.contextWindow),
             apiKey: '',
             logLevel: cfg.log.level,
             // The four fast rows, seeded through the pure mapper so the screen and

package/dist/ui/overlays/ModelProfileEditor.js

@@ -9,8 +9,13 @@ import { stripEnterFrames } from '../enter-frames.js';
 import { pickGlyphs } from '../glyphs.js';
 import { profileEndpointSummary, useProfileScroll } from './ModelProfilePicker.js';
 import { finishProfileEditor } from './model-profile-state.js';
-const FIELDS = ['name', 'provider', 'model', 'baseUrl', 'credentialMode', 'apiKey'];
-const LABELS = ['Name', 'Provider', 'Model', 'Base URL', 'Credential mode', 'API key'];
+// `Context window` sits right after Model: the window is an attribute of the
+// model+endpoint the two rows above name. 14 characters, inside the 18-column
+// label budget `LABELS.map(...padEnd(18))` enforces below.
+const FIELDS = ['name', 'provider', 'model', 'contextWindow', 'baseUrl', 'credentialMode',
+    'apiKey'];
+const LABELS = ['Name', 'Provider', 'Model', 'Context window', 'Base URL', 'Credential mode',
+    'API key'];
 function useEditorInput(props, navigation) {
     const { editor, dispatch } = props;
     const { index, setIndex, retain, count } = navigation;
@@ -83,8 +88,11 @@ function buildEditorRows(props, navigation) {
                 : editor.credentialMode === 'keep' ? 'Configured (unchanged)' : 'Shared / environment';
         if (field === 'credentialMode')
             return editor.credentialMode;
-        return editor[field] || (field === 'name' ? '(defaults to model)' : field === 'baseUrl'
-            ? '(provider default)' : '(required)');
+        // `(auto)` EXPLICITLY, or an empty window field would fall through to
+        // `(required)` - and AUTO is this field's natural state, never a gap.
+        return editor[field] || (field === 'name' ? '(defaults to model)'
+            : field === 'contextWindow' ? '(auto)' : field === 'baseUrl'
+                ? '(provider default)' : '(required)');
     });
     const lines = LABELS.map((label, at) => `${label.padEnd(18)}${values[at]}`);
     if (retain)
@@ -92,6 +100,12 @@ function buildEditorRows(props, navigation) {
     lines.push('Apply to settings draft', 'Cancel editing');
     const rows = lines.map((line, at) => _jsxs(Text, { wrap: "truncate", color: at === index ? props.theme.accent : props.theme.muted, children: [at === index ? `${glyphs.caret} ` : '  ', line] }, at));
     rows.push(_jsxs(Text, { wrap: "truncate", color: props.theme.muted, children: ["Target: ", editor.provider, " ", profileEndpointSummary(editor.baseUrl)] }, "target"));
+    // HONESTY FOR THE FAST-ONLY ENTRY (§6.5): a window saved on a profile that
+    // only ever serves the Fast role does not take effect today, and saying so
+    // beats letting the user believe it does.
+    if (props.users === 'Fast') {
+        rows.push(_jsx(Text, { wrap: "truncate", color: props.theme.muted, children: "Window applies when this profile is bound as Main." }, "window-scope"));
+    }
     return rows;
 }
 /** Replacement key input starts empty; retention across targets is explicit. */