@azure-id/orc 0.56.1 → 1.0.0

package/bin/webui/fixtures/lanes.js

@@ -0,0 +1,218 @@
+"use strict";
+/* fixtures/lanes.js — canned data for `orc ui --fixtures`.
+   The `orc lane` noun: the registry, one lane's phases, and the call catalogue.
+
+   THE RULE FOR EVERY FILE IN HERE: carry ONE OF EVERY STATE, including the
+   ugly ones. For this panel the states that matter are the ones a happy lane
+   never shows you:
+
+     · a lane with NO COMMAND — dispatched by something else, never invoked;
+     · a lane with NO SHARED PHASES — five keep their pipeline in their own
+       spine on purpose, and "none" has to read as an ANSWER rather than as a
+       fetch that failed;
+     · a phase whose `when` is not `always`, and one carrying `optional_when`;
+     · a phase that catalogues NO calls, beside one that catalogues seven;
+     · a call that COSTS something, beside the free ones.
+
+   Shapes MUST match what `bin/cli.js --json` really emits — a drifted fixture
+   is worse than no fixture. These were copied from `orc lane list --json`,
+   `orc lane phases <lane> --json` and `orc lane calls --all --json`. */
+
+const laneList = {
+  ok: true,
+  count: 5,
+  lanes: [
+    // NO COMMAND, and the note that says what opens it instead. An unexplained
+    // null reads as an oversight, which is why the CLI refuses to have one.
+    {
+      lane: "context-combiner",
+      command: null,
+      command_note: "a PHASE inside an orc-analyze run — dispatched, never invoked (v0.42.0)",
+      keys: 2,
+      inert: 0,
+    },
+    { lane: "orc", command: "/orc", command_note: null, keys: 40, inert: 0 },
+    { lane: "orc-mini", command: "/orc-mini", command_note: null, keys: 9, inert: 0 },
+    // INERT rules — the count that tells you some of this lane's keys do
+    // nothing here however they are set.
+    { lane: "orc-quick", command: "/orc-quick", command_note: null, keys: 6, inert: 5 },
+    { lane: "orc-wiki", command: "/orc-wiki", command_note: null, keys: 11, inert: 0 },
+  ],
+  aliases: {},
+  rank_states: ["resolved", "partly-resolved", "not-read", "inert", "demoted", "absent"],
+};
+
+const lanePhases = {
+  orc: {
+    ok: true,
+    lane: "orc",
+    all: false,
+    count: 6,
+    layer_set: ["core", "full"],
+    phase_files: 6,
+    lanes: [
+      {
+        lane: "orc",
+        trace_tier: "Build lanes",
+        trace_token: "orc",
+        phases: [
+          {
+            ord: 1,
+            id: "preflight",
+            file: "_shared/phases/preflight.md",
+            layers: ["core", "full"],
+            read: "whole",
+            when: "always",
+            optional_when: null,
+            calls: [
+              "lane-config",
+              "wiki-status",
+              "pattern-status",
+              "gotcha-status",
+              "pact-status",
+              "boundary-status",
+              "aftermath-status",
+            ],
+          },
+          // A phase that catalogues NO call, directly beside one that
+          // catalogues seven — the empty list has to be visibly empty.
+          {
+            ord: 2,
+            id: "trace",
+            file: "_shared/phases/trace.md",
+            layers: ["core"],
+            read: "whole",
+            when: "always",
+            optional_when: null,
+            calls: [],
+          },
+          {
+            ord: 3,
+            id: "intake",
+            file: "_shared/phases/intake.md",
+            layers: ["core"],
+            read: "whole",
+            when: "on-phase",
+            optional_when: null,
+            calls: [],
+          },
+          // A row that names a HEADING rather than a file — the manifest rule
+          // says a row is one or the other, never both and never neither.
+          {
+            ord: 4,
+            id: "waves",
+            file: null,
+            heading: "## Phase 4 — waves",
+            layers: ["core"],
+            read: "section",
+            when: "on-phase",
+            optional_when: null,
+            calls: ["boundary-status"],
+          },
+          // OPTIONAL, with the condition spelled out. A phase that only
+          // sometimes runs and does not say when is a phase nobody can plan
+          // around.
+          {
+            ord: 5,
+            id: "security",
+            file: "_shared/phases/security.md",
+            layers: ["full"],
+            read: "whole",
+            when: "on-phase",
+            optional_when: "only when security_review is on and a task scored >= 70",
+            calls: [],
+          },
+          {
+            ord: 6,
+            id: "stop-resume",
+            file: "_shared/phases/stop-resume.md",
+            layers: ["core"],
+            read: "whole",
+            when: "always",
+            optional_when: null,
+            calls: ["run-list"],
+          },
+        ],
+      },
+    ],
+  },
+  // IN-SPINE: no shared phases at all. This is the state the panel has to
+  // render as an answer — five lanes are deliberately like this, and a blank
+  // card would make "this lane owns its pipeline" look like "the read failed".
+  "orc-mini": {
+    ok: true,
+    lane: "orc-mini",
+    all: false,
+    count: 0,
+    layer_set: [],
+    phase_files: 0,
+    lanes: [{ lane: "orc-mini", trace_tier: "Build lanes", trace_token: "orc-mini", phases: [] }],
+  },
+};
+
+const laneCalls = {
+  ok: true,
+  lane: null,
+  all: true,
+  count: 4,
+  calls: [
+    {
+      id: "lane-config",
+      cmd: "orc lane config <lane> [--json]",
+      what: "what did this lane's config resolve to, with every shadow and inertness already worded",
+      exits: { 0: "answered", 2: "unknown lane" },
+      states: null,
+      cost: "free",
+      when: "once, at preflight, before the first decision that reads a setting",
+      on_absent:
+        "exit ≠ 0 → say the CLI is unavailable and use the documented defaults, out loud, treating every P0 forcing mode as OFF",
+      never:
+        "never merge `.claude/orc.config.yaml` yourself, and never re-derive a precedence — the answer already carries it",
+      canonical: "_shared/config-precedence.md",
+      lanes: ["orc", "orc-mini", "orc-quick", "orc-wiki"],
+    },
+    {
+      id: "wiki-status",
+      cmd: "orc wiki status [--json]",
+      what: "does a wiki exist here, and how stale is its worst doc",
+      exits: { 0: "answered in every state, including none" },
+      states: ["none", "unregistered", "FRESH", "AGING", "STALE"],
+      cost: "free",
+      when: "once, at preflight",
+      on_absent: "state `none` is an ANSWER — there is no wiki, so nothing consults one",
+      never: "never compute the tier yourself, and never store it",
+      canonical: "_shared/detecting-artifacts.md",
+      lanes: ["orc", "orc-fast", "orc-learn", "orc-wiki"],
+    },
+    // A call that COSTS. Every other row here is free, and a panel where every
+    // chip says the same word teaches nothing.
+    {
+      id: "wiki-refresh",
+      cmd: "/orc-wiki refresh --top <n>",
+      what: "re-scan the ranked docs a delta actually touched",
+      exits: { 0: "refreshed", 1: "nothing pending" },
+      states: null,
+      cost: "paid",
+      when: "only when the user asked for it, and only after every free repair ran",
+      on_absent: "nothing pending is an ANSWER — do not scan to produce work",
+      never: "never run it to clear a caution the free repairs would have cleared",
+      canonical: "orc-wiki/references/staleness.md",
+      lanes: ["orc-wiki"],
+    },
+    {
+      id: "run-list",
+      cmd: "orc run list [--limit <n>] [--json]",
+      what: "which runs are unfinished, and what each one was doing when it stopped",
+      exits: { 0: "answered, including an empty list" },
+      states: null,
+      cost: "free",
+      when: "at a stop, and when the user asks what is open",
+      on_absent: "an empty list is an ANSWER — no run is waiting",
+      never: "never claim a run finished; the disk only proves it stopped",
+      canonical: "_shared/phases/stop-resume.md",
+      lanes: ["orc", "orc-doc", "orc-mini"],
+    },
+  ],
+};
+
+module.exports = { laneList, lanePhases, laneCalls };

package/bin/webui/fixtures/settings.js

@@ -9,7 +9,10 @@
    test asserts this, so a new state cannot ship without one.
 
    Shapes MUST match what `bin/cli.js --json` really emits — a drifted
-   fixture is worse than no fixture. */
+   fixture is worse than no fixture. The v1.0.0 W2 fields (answers/family/prio/
+   lanes/gated_by per key, and the `families` table) were copied straight from
+   the live registry for that reason — a shadow you can design against has to
+   carry the RANK that causes it, not just the sentence. */
 
 const { PROJECT } = require("./shell.js");
 
@@ -17,40 +20,52 @@ const config = {
   config_path: PROJECT + "/.claude/orc.config.yaml",
   exists: true,
   keys: [
-    { key: "max_wave_tasks", tier: "common", value: 4, default: 3, is_overridden: true, is_shadowed: false, shadow_reason: null, desc: "Max parallel tasks per execution wave (higher = more parallelism, more collision risk).", options: [2, 3, 4, 5], control: { kind: "int", choices: null, min: 1, max: null } },
-    { key: "batch_pause_every", tier: "common", value: 2, default: 2, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Waves between stop-and-continue pauses (1 = pause every wave).", options: [1, 2, 3, 4, 5], control: { kind: "int", choices: null, min: 1, max: null } },
-    { key: "rubric_bands", tier: "common", value: 5, default: 5, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Scoring granularity (2-5 narrow preset, 6-8 wide preset).", options: [2, 3, 4, 5, 6, 7, 8], control: { kind: "range", choices: null, min: 2, max: 8 } },
-    { key: "pattern_findings", tier: "common", value: "on", default: "ask", is_overridden: true, is_shadowed: false, shadow_reason: null, desc: "Code-pattern gate on an FE/BE cache miss.", options: ["ask", "on", "off"], control: { kind: "enum", choices: ["ask", "on", "off"], min: null, max: null } },
-    { key: "generate_tests", tier: "common", value: false, default: false, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Opt-in Phase 6.5: author test cases before ship.", options: ["true", "false"], control: { kind: "enum", choices: ["true", "false"], min: null, max: null } },
-    // ON, so the whole fable5_* block below renders shadowed — the animation
-    // §6.2 calls the single best argument for the project.
-    { key: "opus5_only", tier: "common", value: "true", default: false, is_overridden: true, is_shadowed: false, shadow_reason: null, desc: "EVERY dispatched role uses ONE model — Opus 5 — with EFFORT as the cost dial.", options: ["true", "false"], control: { kind: "enum", choices: ["true", "false"], min: null, max: null } },
-    { key: "fable5_enabled", tier: "fable5", value: "true", default: false, is_overridden: true, is_shadowed: true, shadow_reason: "shadowed by opus5_only — every role dispatches its Opus 5 agent, so the Fable 5 override is inert", desc: "Master gate — route selected roles to Fable 5 agents.", options: ["true", "false"], control: { kind: "enum", choices: ["true", "false"], min: null, max: null } },
-    { key: "fable5_effort", tier: "fable5", value: "medium", default: "medium", is_overridden: false, is_shadowed: true, shadow_reason: "shadowed by opus5_only — every role dispatches its Opus 5 agent, so the Fable 5 override is inert", desc: "Effort for the Fable 5 role agents.", options: ["medium", "high", "xhigh", "max"], control: { kind: "enum", choices: ["medium", "high", "xhigh", "max"], min: null, max: null } },
-    { key: "fable5_roles", tier: "fable5", value: "[analyze, plan]", default: "[]", is_overridden: true, is_shadowed: true, shadow_reason: "shadowed by opus5_only — every role dispatches its Opus 5 agent, so the Fable 5 override is inert", desc: "Which roles use Fable 5 (CSV).", options: ["analyze", "plan", "advisor", "judge", "review"], control: { kind: "subset", choices: ["analyze", "plan", "advisor", "judge", "review"], min: null, max: null } },
-    { key: "wiki_fresh_max", tier: "advanced", value: 10, default: 10, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Wiki freshness: commit distance < this → FRESH.", options: null, control: { kind: "int", choices: null, min: 1, max: null } },
-    { key: "wiki_aging_max", tier: "advanced", value: 30, default: 30, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Wiki freshness: commit distance <= this → AGING; beyond → STALE.", options: null, control: { kind: "int", choices: null, min: 1, max: null } },
-    { key: "log_dir", tier: "advanced", value: ".claude/orc/logs", default: ".claude/orc/logs", is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Persistent trace folder (never auto-deleted).", options: null, control: { kind: "path", choices: null, min: null, max: null } },
-    { key: "retro_repo", tier: "advanced", value: "azure-id/orc", default: "azure-id/orc", is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "GitHub owner/repo that receives /orc-retro reports.", options: null, control: { kind: "repo", choices: null, min: null, max: null } },
+    { key: "max_wave_tasks", tier: "common", answers: [{"family":"waves","prio":"P2","mode":"replace"}], family: "waves", prio: "P2", lanes: ["orc","orc-diy"], gated_by: null, value: 4, default: 3, is_overridden: true, is_shadowed: false, shadow_reason: null, desc: "Max parallel tasks per execution wave (higher = more parallelism, more collision risk).", options: [2, 3, 4, 5], control: { kind: "int", choices: null, min: 1, max: null } },
+    { key: "batch_pause_every", tier: "common", answers: [{"family":"waves","prio":"P2","mode":"replace"}], family: "waves", prio: "P2", lanes: ["orc","orc-diy"], gated_by: null, value: 2, default: 2, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Waves between stop-and-continue pauses (1 = pause every wave).", options: [1, 2, 3, 4, 5], control: { kind: "int", choices: null, min: 1, max: null } },
+    { key: "rubric_bands", tier: "common", answers: [{"family":"scoring","prio":"P2","mode":"replace"}], family: "scoring", prio: "P2", lanes: ["orc","orc-diy"], gated_by: null, value: 5, default: 5, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Scoring granularity (2-5 narrow preset, 6-8 wide preset).", options: [2, 3, 4, 5, 6, 7, 8], control: { kind: "range", choices: null, min: 2, max: 8 } },
+    { key: "pattern_findings", tier: "common", answers: [{"family":"patterns","prio":"P2","mode":"replace"}], family: "patterns", prio: "P2", lanes: ["orc","orc-pattern","orc-wiki"], gated_by: null, value: "on", default: "ask", is_overridden: true, is_shadowed: false, shadow_reason: null, desc: "Code-pattern gate on an FE/BE cache miss.", options: ["ask", "on", "off"], control: { kind: "enum", choices: ["ask", "on", "off"], min: null, max: null } },
+    { key: "generate_tests", tier: "common", answers: [{"family":"testing","prio":"P2","mode":"replace"}], family: "testing", prio: "P2", lanes: ["orc","orc-mini"], gated_by: null, value: false, default: false, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Opt-in Phase 6.5: author test cases before ship.", options: ["true", "false"], control: { kind: "enum", choices: ["true", "false"], min: null, max: null } },
+    // ON, and PARTLY SHADOWED by the extra overlay above it — the animation
+    // §6.2 calls the single best argument for the project. Since v1.0.0 W3
+    // removed the Fable 5 block, the overlay is the ONLY way a registry key
+    // reaches `is_shadowed`, so this row is the fixture set's whole coverage of
+    // that state. Do not quietly make it false.
+    { key: "opus5_only", tier: "common", answers: [{"family":"executor-band","prio":"P1","mode":"replace"},{"family":"fixed-role-model","prio":"P1","mode":"replace"}], family: "executor-band", prio: "P1", lanes: ["orc","orc-analyze","orc-challenge","orc-claude","orc-diy","orc-doc","orc-fast","orc-mini","orc-pattern","orc-quick","orc-retro","orc-wiki"], gated_by: null, value: "true", default: false, is_overridden: true, is_shadowed: true, shadow_reason: "partly shadowed by extra_enabled — [0,30), [30,55), [50,60), [60,70) are routed to a non-Claude worker; the quick-executor, doc-writer position is held by one too (not consulted here); every other score and position still resolves here", desc: "EVERY dispatched role uses ONE model — Opus 5 — with EFFORT as the cost dial.", options: ["true", "false"], control: { kind: "enum", choices: ["true", "false"], min: null, max: null } },
+    { key: "wiki_fresh_max", tier: "advanced", answers: [{"family":"wiki","prio":"P2","mode":"replace"}], family: "wiki", prio: "P2", lanes: ["orc","orc-fast","orc-learn","orc-wiki"], gated_by: null, value: 10, default: 10, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Wiki freshness: commit distance < this → FRESH.", options: null, control: { kind: "int", choices: null, min: 1, max: null } },
+    { key: "wiki_aging_max", tier: "advanced", answers: [{"family":"wiki","prio":"P2","mode":"replace"}], family: "wiki", prio: "P2", lanes: ["orc","orc-fast","orc-learn","orc-wiki"], gated_by: null, value: 30, default: 30, is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Wiki freshness: commit distance <= this → AGING; beyond → STALE.", options: null, control: { kind: "int", choices: null, min: 1, max: null } },
+    { key: "log_dir", tier: "advanced", answers: [{"family":"paths","prio":"P2","mode":"replace"}], family: "paths", prio: "P2", lanes: ["context-combiner","orc","orc-aftermath","orc-analyze","orc-analyze-mini","orc-boundary","orc-brainstorm","orc-budget","orc-challenge","orc-claude","orc-diy","orc-doc","orc-explain","orc-export","orc-fast","orc-grill","orc-handoff","orc-learn","orc-mini","orc-pact","orc-pattern","orc-poly","orc-pr-driver","orc-pr-setup","orc-quick","orc-retro","orc-route","orc-verify","orc-wiki"], gated_by: null, value: ".claude/orc/logs", default: ".claude/orc/logs", is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Persistent trace folder (never auto-deleted).", options: null, control: { kind: "path", choices: null, min: null, max: null } },
+    { key: "retro_repo", tier: "advanced", answers: [{"family":"retro","prio":"P2","mode":"replace"}], family: "retro", prio: "P2", lanes: ["orc","orc-retro"], gated_by: null, value: "azure-id/orc", default: "azure-id/orc", is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "GitHub owner/repo that receives /orc-retro reports.", options: null, control: { kind: "repo", choices: null, min: null, max: null } },
     // v0.50.0 — the nine `orc extra` keys, copied from the live registry so the
     // shapes cannot drift. `extra_enabled` is TRUE here on purpose: an ARMED
     // subsystem is the state that needs designing.
-    {"key": "extra_enabled", "tier": "common", "value": true, "default": false, "is_overridden": true, "is_shadowed": false, "shadow_reason": null, "desc": "Master gate for `orc extra` — dispatching a scored task to a non-Claude worker (DeepSeek, GLM, Kimi, a local Ollama, any OpenAI-/Anthropic-compatible endpoint you can name). NOTHING changes unless true, the fable5_enabled precedent. The orchestrator always stays Claude; what moves is who executes a slice. Every run that will cross the boundary PRINTS it at Phase 1 — routing work off Claude silently is the failure mode this whole subsystem is shaped around.", "options": ["true", "false"], "control": {"kind": "enum", "choices": ["true", "false"], "min": null, "max": null}},
-    {"key": "extra_roles", "tier": "common", "value": "[executor]", "default": "[executor]", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Which dispatched roles may go foreign (CSV). Executor only by default, deliberately: an executor's output is checked by the smoke gate, the TDD gate, the reviewer and the worktree-delta check, all of which are engine-blind — while a REVIEWER you cannot trust is worse than no reviewer at all, because it launders a finding nobody made.", "options": ["executor", "reviewer", "verifier", "analyst", "planner", "scout", "test-author", "doc-writer", "doc-checker"], "control": {"kind": "subset", "choices": ["executor", "reviewer", "verifier", "analyst", "planner", "scout", "test-author", "doc-writer", "doc-checker"], "min": null, "max": null}},
-    {"key": "extra_risk_tasks", "tier": "common", "value": "off", "default": "off", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Whether a task with a non-empty cited `risk[]` (auth, money, migration, security, concurrency, data-integrity) may leave Claude. OFF holds it on the Claude ladder whatever the route table says, and the preflight NAMES it as held back. ORC already refuses to send a refund-endpoint change to a cheap model; this keeps Extra from becoming the hole in that rule.", "options": ["off", "on"], "control": {"kind": "enum", "choices": ["off", "on"], "min": null, "max": null}},
-    {"key": "extra_on_failure", "tier": "common", "value": "fallback", "default": "fallback", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "What an unreachable endpoint, a 401, a 429 past backoff, a timeout or a malformed return does. `fallback` re-dispatches the task to the Claude band it would have had, ANNOUNCED, and the run continues. `stop` is for people who would rather stop than silently start paying Anthropic rates. A failed foreign dispatch is never a dead run either way.", "options": ["fallback", "stop"], "control": {"kind": "enum", "choices": ["fallback", "stop"], "min": null, "max": null}},
-    {"key": "extra_max_concurrent", "tier": "common", "value": 1, "default": 1, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Foreign dispatches in flight at once. Per-provider rate limits are undocumented in aggregate, so 1 is the honest default — a wave of 3 that 429s costs more in repairs than the parallelism saved.", "options": [1, 2, 3], "control": {"kind": "int", "choices": null, "min": 1, "max": null}},
-    {"key": "extra_unlock", "tier": "common", "value": "per-run", "default": "per-run", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "When a vault-stored key asks for its passphrase. `per-run` asks ONCE at the Phase-1 stop the lane already has, so an unattended wave can actually run. `per-dispatch` prompts every time and REFUSES to start an unattended wave, naming why — it is interactive-only by design. Irrelevant when the credential source is an environment variable, which is the recommended one.", "options": ["per-run", "per-dispatch"], "control": {"kind": "enum", "choices": ["per-run", "per-dispatch"], "min": null, "max": null}},
-    {"key": "extra_vault_max_attempts", "tier": "advanced", "value": 10, "default": 10, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Wrong passphrases before the encrypted key DELETES ITSELF. It is a key rather than a magic number so the count is inspectable and testable — NOT so it can be switched off; below 3 is refused. The counter stops someone at your keyboard; it does not stop someone who copies the vault file and tries offline, and scrypt's cost is the only defence there.", "options": null, "control": {"kind": "int", "choices": null, "min": 3, "max": null}},
-    {"key": "extra_timeout_s", "tier": "advanced", "value": 900, "default": 900, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Per-dispatch wall clock for a foreign worker. The child's own timeouts are DERIVED from this rather than set independently, so three timeouts cannot disagree about which one fires first.", "options": null, "control": {"kind": "int", "choices": null, "min": 30, "max": null}},
-    {"key": "extra_verify_max_days", "tier": "advanced", "value": 7, "default": 7, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Past this a profile's verification reads STALE and is re-pinged before wave 1. A STALE profile STILL ROUTES — a stale check is not a failed one (the /orc-pact UNCHECKABLE rule) — and freshness is computed on read, never stored.", "options": null, "control": {"kind": "int", "choices": null, "min": 1, "max": null}},
-    { key: "orchestrator_model", tier: "advanced", value: "claude-opus-4-8", tierNote: null, default: "claude-opus-4-8", is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Main-session model (below Opus breaks the tier ladder).", options: null, control: { kind: "enum", choices: ["claude-opus-5", "claude-opus-4-8", "claude-sonnet-5"], min: null, max: null } },
+    {"key": "extra_enabled", "tier": "common", answers: [{"family":"executor-band","prio":"P0","mode":"overlay"},{"family":"fixed-role-model","prio":"P0","mode":"overlay"}], family: "executor-band", prio: "P0", lanes: ["orc","orc-boundary","orc-challenge","orc-diy","orc-doc","orc-fast","orc-mini","orc-quick","orc-wiki"], gated_by: null, "value": true, "default": false, "is_overridden": true, "is_shadowed": false, "shadow_reason": null, "desc": "Master gate for `orc extra` — dispatching a scored task to a non-Claude worker (DeepSeek, GLM, Kimi, a local Ollama, any OpenAI-/Anthropic-compatible endpoint you can name). NOTHING changes unless true. The orchestrator always stays Claude; what moves is who executes a slice. Every run that will cross the boundary PRINTS it at Phase 1 — routing work off Claude silently is the failure mode this whole subsystem is shaped around.", "options": ["true", "false"], "control": {"kind": "enum", "choices": ["true", "false"], "min": null, "max": null}},
+    {"key": "extra_roles", "tier": "common", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: ["orc-doc","orc-wiki"], gated_by: "extra_enabled", "value": "[executor]", "default": "[executor]", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Which dispatched roles may go foreign (CSV). Executor only by default, deliberately: an executor's output is checked by the smoke gate, the TDD gate, the reviewer and the worktree-delta check, all of which are engine-blind — while a REVIEWER you cannot trust is worse than no reviewer at all, because it launders a finding nobody made.", "options": ["executor", "reviewer", "verifier", "analyst", "planner", "scout", "test-author", "doc-writer", "doc-checker"], "control": {"kind": "subset", "choices": ["executor", "reviewer", "verifier", "analyst", "planner", "scout", "test-author", "doc-writer", "doc-checker"], "min": null, "max": null}},
+    {"key": "extra_risk_tasks", "tier": "common", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: ["orc","orc-diy","orc-mini"], gated_by: "extra_enabled", "value": "off", "default": "off", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Whether a task with a non-empty cited `risk[]` (auth, money, migration, security, concurrency, data-integrity) may leave Claude. OFF holds it on the Claude ladder whatever the route table says, and the preflight NAMES it as held back. ORC already refuses to send a refund-endpoint change to a cheap model; this keeps Extra from becoming the hole in that rule.", "options": ["off", "on"], "control": {"kind": "enum", "choices": ["off", "on"], "min": null, "max": null}},
+    {"key": "extra_on_failure", "tier": "common", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: ["orc-quick","orc-wiki"], gated_by: "extra_enabled", "value": "fallback", "default": "fallback", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "What an unreachable endpoint, a 401, a 429 past backoff, a timeout or a malformed return does. `fallback` re-dispatches the task to the Claude band it would have had, ANNOUNCED, and the run continues. `stop` is for people who would rather stop than silently start paying Anthropic rates. A failed foreign dispatch is never a dead run either way.", "options": ["fallback", "stop"], "control": {"kind": "enum", "choices": ["fallback", "stop"], "min": null, "max": null}},
+    {"key": "extra_max_concurrent", "tier": "common", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: [], gated_by: "extra_enabled", "value": 1, "default": 1, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Foreign dispatches in flight at once. Per-provider rate limits are undocumented in aggregate, so 1 is the honest default — a wave of 3 that 429s costs more in repairs than the parallelism saved.", "options": [1, 2, 3], "control": {"kind": "int", "choices": null, "min": 1, "max": null}},
+    {"key": "extra_unlock", "tier": "common", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: [], gated_by: "extra_enabled", "value": "per-run", "default": "per-run", "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "When a vault-stored key asks for its passphrase. `per-run` asks ONCE at the Phase-1 stop the lane already has, so an unattended wave can actually run. `per-dispatch` prompts every time and REFUSES to start an unattended wave, naming why — it is interactive-only by design. Irrelevant when the credential source is an environment variable, which is the recommended one.", "options": ["per-run", "per-dispatch"], "control": {"kind": "enum", "choices": ["per-run", "per-dispatch"], "min": null, "max": null}},
+    {"key": "extra_vault_max_attempts", "tier": "advanced", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: [], gated_by: "extra_enabled", "value": 10, "default": 10, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Wrong passphrases before the encrypted key DELETES ITSELF. It is a key rather than a magic number so the count is inspectable and testable — NOT so it can be switched off; below 3 is refused. The counter stops someone at your keyboard; it does not stop someone who copies the vault file and tries offline, and scrypt's cost is the only defence there.", "options": null, "control": {"kind": "int", "choices": null, "min": 3, "max": null}},
+    {"key": "extra_timeout_s", "tier": "advanced", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: [], gated_by: "extra_enabled", "value": 900, "default": 900, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Per-dispatch wall clock for a foreign worker. The child's own timeouts are DERIVED from this rather than set independently, so three timeouts cannot disagree about which one fires first.", "options": null, "control": {"kind": "int", "choices": null, "min": 30, "max": null}},
+    {"key": "extra_verify_max_days", "tier": "advanced", answers: [{"family":"extra","prio":"P2","mode":"replace"}], family: "extra", prio: "P2", lanes: [], gated_by: "extra_enabled", "value": 7, "default": 7, "is_overridden": false, "is_shadowed": false, "shadow_reason": null, "desc": "Past this a profile's verification reads STALE and is re-pinged before wave 1. A STALE profile STILL ROUTES — a stale check is not a failed one (the /orc-pact UNCHECKABLE rule) — and freshness is computed on read, never stored.", "options": null, "control": {"kind": "int", "choices": null, "min": 1, "max": null}},
+    { key: "orchestrator_model", tier: "advanced", answers: [{"family":"session","prio":"P2","mode":"replace"}], family: "session", prio: "P2", lanes: ["orc"], gated_by: null, value: "claude-opus-4-8", tierNote: null, default: "claude-opus-4-8", is_overridden: false, is_shadowed: false, shadow_reason: null, desc: "Main-session model (below Opus breaks the tier ladder).", options: null, control: { kind: "enum", choices: ["claude-opus-5", "claude-opus-4-8", "claude-sonnet-5"], min: null, max: null } },
   ],
   // The registry-less, hand-written key — read-only everywhere, and shadowed here.
   hand_edited: [
-    { key: "rubric_bands_override", value: "[[0,50,'orc-executor-sonnet-5-high'],[50,100,'orc-executor-opus-5-high']]", is_shadowed: true, shadow_reason: "shadowed by opus5_only — executors use the fixed 3-band Opus 5 ladder", editable: false },
+    { key: "rubric_bands_override", value: "[[0,50,'orc-executor-sonnet-5-high'],[50,100,'orc-executor-opus-5-high']]", is_shadowed: true, shadow_reason: "shadowed by opus5_only — executors use the fixed 2-band Opus 5 ladder", editable: false },
   ],
   legacy_keys: [{ key: "opus5_executor_only", renamed_to: "opus5_only" }],
+  // A key that was REMOVED, not renamed — the ugly state `--fixtures` exists to
+  // carry. You cannot design the "still on disk, no longer read" row against a
+  // clean config, and a panel that renders it as an editable setting is the
+  // failure this field prevents.
+  retired_keys: [
+    {
+      key: "fable5_enabled",
+      value: "true",
+      removed_in: "1.0.0",
+      why: "the Fable 5 role override was removed — every role dispatches its shipped Claude agent, or the Opus 5 variant under opus5_only",
+    },
+  ],
   score_table: {
     active: "opus5_only",
     default: [
@@ -58,17 +73,229 @@ const config = {
       { from: 30, to: 40, inclusive_to: false, agent: "orc-executor-sonnet-4-6-med" },
       { from: 40, to: 55, inclusive_to: false, agent: "orc-executor-sonnet-4-6-high" },
       { from: 55, to: 65, inclusive_to: false, agent: "orc-executor-sonnet-5-high" },
-      { from: 65, to: 70, inclusive_to: false, agent: "orc-executor-opus-4-7-med" },
-      { from: 70, to: 80, inclusive_to: false, agent: "orc-executor-opus-4-7-high" },
-      { from: 80, to: 90, inclusive_to: false, agent: "orc-executor-opus-4-8-high" },
-      { from: 90, to: 100, inclusive_to: true, agent: "orc-executor-opus-5-high" },
+      { from: 65, to: 90, inclusive_to: false, agent: "orc-executor-opus-5-low" },
+      { from: 90, to: 100, inclusive_to: true, agent: "orc-executor-opus-5-med" },
     ],
     opus5_only: [
-      { from: 0, to: 40, inclusive_to: false, agent: "orc-executor-opus-5-low" },
-      { from: 40, to: 80, inclusive_to: false, agent: "orc-executor-opus-5-med" },
-      { from: 80, to: 100, inclusive_to: true, agent: "orc-executor-opus-5-high" },
+      { from: 0, to: 90, inclusive_to: false, agent: "orc-executor-opus-5-low" },
+      { from: 90, to: 100, inclusive_to: true, agent: "orc-executor-opus-5-med" },
     ],
   },
+  families: {
+    "executor-band": {
+      "contested": true,
+      "question": "which model executes a SCORED task",
+      "ranks": [
+        {
+          "prio": "P0",
+          "key": "extra_enabled",
+          "mode": "overlay"
+        },
+        {
+          "prio": "P1",
+          "key": "opus5_only",
+          "mode": "replace"
+        },
+        {
+          "prio": "P2",
+          "key": "rubric_bands_override",
+          "mode": "replace",
+          "registry_less": true,
+          "shadow_note": "shadowed by {by} — executors use the fixed 2-band Opus 5 ladder"
+        },
+        {
+          "prio": "P3",
+          "key": null,
+          "terminal": "the shipped score→model table"
+        }
+      ]
+    },
+    "fixed-role-model": {
+      "contested": true,
+      "question": "which model runs a role that has no score",
+      "ranks": [
+        {
+          "prio": "P0",
+          "key": "extra_enabled",
+          "mode": "overlay"
+        },
+        {
+          "prio": "P1",
+          "key": "opus5_only",
+          "mode": "replace"
+        },
+        {
+          "prio": "P2",
+          "key": null,
+          "terminal": "the agent shipped for that position"
+        }
+      ]
+    },
+    "waves": {
+      "contested": false,
+      "question": "how a run is broken into waves and when it pauses"
+    },
+    "scoring": {
+      "contested": false,
+      "question": "how finely a task is scored"
+    },
+    "analysis": {
+      "contested": false,
+      "question": "how wide the analyst sweeps before planning"
+    },
+    "testing": {
+      "contested": false,
+      "question": "which tests a run writes, and how long it repairs"
+    },
+    "patterns": {
+      "contested": false,
+      "question": "when the project's code conventions are learned"
+    },
+    "gotchas": {
+      "contested": false,
+      "question": "what repair memory is kept and injected"
+    },
+    "security": {
+      "contested": false,
+      "question": "when a security pass runs"
+    },
+    "mock": {
+      "contested": false,
+      "question": "when a runnable mocked example is produced"
+    },
+    "pr": {
+      "contested": false,
+      "question": "when a change ships as a stack instead of one PR"
+    },
+    "extra": {
+      "contested": false,
+      "question": "how a foreign dispatch behaves once extra is on"
+    },
+    "pact": {
+      "contested": false,
+      "question": "what a drifted promise does to a run"
+    },
+    "boundary": {
+      "contested": false,
+      "question": "what a refused area does to a wave"
+    },
+    "handoff": {
+      "contested": false,
+      "question": "whether a non-engineer may write a graded surface"
+    },
+    "budget": {
+      "contested": false,
+      "question": "how a cost forecast is computed and shown"
+    },
+    "aftermath": {
+      "contested": false,
+      "question": "how far back a run is graded from the repo's future"
+    },
+    "challenge": {
+      "contested": false,
+      "question": "what counts as a pass, and which lenses run"
+    },
+    "doc": {
+      "contested": false,
+      "question": "how a long document is written and checked"
+    },
+    "wiki": {
+      "contested": false,
+      "question": "how the project wiki is scanned and when it is stale"
+    },
+    "crosslink": {
+      "contested": false,
+      "question": "when a peer repo's wiki reads stale"
+    },
+    "retro": {
+      "contested": false,
+      "question": "where a retro is delivered"
+    },
+    "paths": {
+      "contested": false,
+      "question": "where ORC writes on disk"
+    },
+    "session": {
+      "contested": false,
+      "question": "what the main session itself runs as"
+    }
+  },
+  // THE FAMILY TABLE RESOLVED (v1.0.0 W16), and the state set is why it is here.
+  // `families` above is the static registry; this is what those ranks actually
+  // did. Shapes copied from `orc config list --json`'s `families_resolved`.
+  //
+  // ONE OF EVERY REACHABLE STATE, per this folder's standing rule. `demoted` is
+  // the ugly one and the reason the fixture is shaped this way at all: you
+  // cannot design a demotion row against a project where nothing was ever
+  // demoted, and the wording has to carry the run, the profiles and the command
+  // that clears it.
+  //
+  // TWO of the six states are DELIBERATELY not here, each because the real CLI
+  // could not emit it either — a fixture carrying a state its own command
+  // cannot produce is a fixture lying about the thing it stands in for.
+  //
+  //   `inert`  — inertness is a fact about a LANE ("/orc-quick does not read
+  //              this"), and `families_resolved` resolves project-wide with no
+  //              lane. It IS on this panel, on the per-key rows, where
+  //              `state: "inert"` genuinely occurs; `orc lane config <lane>
+  //              --json` is the command that produces it in a family.
+  //   `absent` — a rank is `absent` only when it was CONSULTED and declined.
+  //              Here `opus5_only` is on and resolves at P1, so everything
+  //              below it is `not-read` instead. It is the state a project with
+  //              nothing configured shows for every rank — the default `orc ui`
+  //              experience — and it renders as a plain chip exactly like
+  //              `not-read`, so there is no styling it hides.
+  //
+  // The legend still shows the CLI's whole closed set, because that is what
+  // `rank_states` publishes and the legend's job is to explain the vocabulary,
+  // not to inventory this page.
+  families_resolved: {
+    "executor-band": {
+      contested: true,
+      question: "which model executes a SCORED task",
+      resolved_by: "opus5_only",
+      resolved_at: "P1",
+      inert: false,
+      inert_reason: null,
+      ranks: [
+        {
+          prio: "P0",
+          key: "extra_enabled",
+          terminal: null,
+          state: "demoted",
+          why: 'deepseek demoted for run add-oauth-login — 2 consecutive stalled dispatches. 1 row(s) on another profile still route. orc extra promote add-oauth-login --reason "<why>"',
+        },
+        { prio: "P1", key: "opus5_only", terminal: null, state: "resolved", why: null },
+        { prio: "P2", key: "rubric_bands_override", terminal: null, state: "not-read", why: "a higher rank resolved" },
+        { prio: "P3", key: null, terminal: "the shipped score→model table", state: "not-read", why: "a higher rank resolved" },
+      ],
+    },
+    "fixed-role-model": {
+      contested: true,
+      question: "which model runs a role that has no score",
+      // `partly-resolved` does NOT set `resolved_by` — an overlay takes only
+      // the positions its slot rows name, so the ladder carries on and the rank
+      // BELOW it is the one that answered. Getting this wrong in a fixture
+      // would teach the panel to render a contradiction.
+      resolved_by: "opus5_only",
+      resolved_at: "P1",
+      inert: false,
+      inert_reason: null,
+      ranks: [
+        {
+          prio: "P0",
+          key: "extra_enabled",
+          terminal: null,
+          state: "partly-resolved",
+          why: "the quick-executor and doc-writer positions are held by a route row; every other position falls through",
+        },
+        { prio: "P1", key: "opus5_only", terminal: null, state: "resolved", why: null },
+        { prio: "P2", key: null, terminal: "the agent shipped for that position", state: "not-read", why: "a higher rank resolved" },
+      ],
+    },
+  },
+  // The CLI's closed set, published so the legend never invents a word.
+  rank_states: ["resolved", "partly-resolved", "not-read", "inert", "demoted", "absent"],
   behavior_trace: { always_on: true, configurable_key: "log_dir" },
 };
 

package/bin/webui/fixtures/stats.js

@@ -48,14 +48,14 @@ const budgetForecast = {
   price_table: { as_of: "2026-08-01", age_days: 9, stale: false, path: "bin/pricing.json" },
   quota: { available: true, plan: "max20", label: "Max 20x", window_pct: 18.2, weekly_pct: 4.1 },
   // A task at CONTEXT RISK — the state that cannot be designed on a small plan.
-  context_risk: [{ task: "T12", agent: "orc-executor-opus-5-high", peak: 189000, window: 200000, pct: 95 }],
+  context_risk: [{ task: "T12", agent: "orc-executor-opus-5-med", peak: 189000, window: 200000, pct: 95 }],
   bands: [
     { band: "[0,30)", agent: "orc-executor-haiku-4-5", count: 2, tasks: ["T01", "T02"], samples: 9, p50: { input: 1200, cache_write: 6400, cache_read: 11800, output: 900 }, p90: { input: 1800, cache_write: 9200, cache_read: 17000, output: 1400 } },
     { band: "[40,55)", agent: "orc-executor-sonnet-4-6-high", count: 3, tasks: ["T03", "T05", "T07"], samples: 12, p50: { input: 7800, cache_write: 52100, cache_read: 104000, output: 8400 }, p90: { input: 11000, cache_write: 75000, cache_read: 150000, output: 12000 } },
-    { band: "[70,80)", agent: "orc-executor-opus-4-7-high", count: 1, tasks: ["T04"], samples: 6, p50: { input: 5700, cache_write: 40200, cache_read: 81000, output: 9300 }, p90: { input: 8100, cache_write: 58000, cache_read: 117000, output: 13400 } },
+    { band: "[65,90)", agent: "orc-executor-opus-5-low", count: 1, tasks: ["T04"], samples: 6, p50: { input: 5700, cache_write: 40200, cache_read: 81000, output: 9300 }, p90: { input: 8100, cache_write: 58000, cache_read: 117000, output: 13400 } },
     // A band with insufficient history — the low-confidence warning is not
     // optional chrome, so the fixture has to be able to trigger it.
-    { band: "[90,100]", agent: "orc-executor-opus-5-high", count: 1, tasks: ["T12"], samples: 2, p50: { input: 9100, cache_write: 61000, cache_read: 128000, output: 17000 }, p90: { input: 14000, cache_write: 94000, cache_read: 198000, output: 26000 } },
+    { band: "[90,100]", agent: "orc-executor-opus-5-med", count: 1, tasks: ["T12"], samples: 2, p50: { input: 9100, cache_write: 61000, cache_read: 128000, output: 17000 }, p90: { input: 14000, cache_write: 94000, cache_read: 198000, output: 26000 } },
   ],
   fixed_roles: [
     { role: "orc-system-analyst-opus-5-high", samples: 11, p50: { input: 6100, cache_write: 41000, cache_read: 82000, output: 9000 }, p90: { input: 8600, cache_write: 58000, cache_read: 116000, output: 13000 } },