@bytesbrains/cruise-worker 0.0.0-stage → 0.12.1

package/migrations/0081_grok_imagine.sql

@@ -0,0 +1,81 @@
+-- Grok Imagine: the first models priced per image (#284), unlocked by `priced_by`
+-- (#240, 0080). Video rows stay out — no `/v1/video/*` route and #220 said nobody
+-- is blocked on them.
+--
+-- ## Measured, 2026-09-13 (UTC)
+--
+-- Direct to `https://api.x.ai/v1/images/generations` with an xAI key:
+--
+--   model + prompt + n + response_format=b64_json|url     200, `data[0].b64_json`
+--                                                         or `.url`, plus `mime_type`;
+--                                                         `usage.cost_in_usd_ticks`
+--                                                         only — no token counts
+--   + aspect_ratio / resolution                           200
+--   + quality low|medium|high|auto                        200
+--   + size (OpenAI's field)                               400, "Argument not supported: size"
+--   + quality=standard (OpenAI's word)                    422, unknown variant
+--
+-- So the path is OpenAI-compatible enough for Cruise's images route, but the
+-- body is not a free pass-through: `size` must be stripped and an OpenAI
+-- `quality` value remapped or dropped. That lives in `src/images-grok.ts`, the
+-- same shape as ElevenLabs for speech — a host whose wire is almost OpenAI's
+-- and not quite.
+--
+-- Prices from each model's page on docs.x.ai the same day, matching the ticks
+-- the live responses printed ($0.02 / $0.05 / $0.04 → 20k / 50k / 40k micros):
+--
+--   grok-imagine-image          $0.02 / image
+--   grok-imagine-image-quality  $0.05 / image
+--   grok-imagine-image-2.0      $0.04 / image
+--
+-- Flat rates, one figure per model — no size×quality grid. The `image`
+-- component's `variant` is therefore `''`, and `/v1/models` publishes that as
+-- the accepted set via the price log (#240). **`model_image_variants` is not
+-- written for these rows**: that table's `output_tokens NOT NULL` is the bound
+-- for a token-priced image model, and a per-image model has no such number.
+-- Making the column nullable was option 1 on #284; not writing the table for
+-- `priced_by = 'component'` is the same fact written once — `priced_by` already
+-- says the bound is the component, not a measured token count.
+--
+-- ## Path on the gateway
+--
+-- Chat stays on `/compat`. Images take the provider path (`src/images.ts`),
+-- which appends `/images/generations` with no version of its own — OpenAI's
+-- gateway provider supplies `/v1`, xAI's API lives under `/v1`, so the
+-- upstream's `provider_path_prefix` is `/v1`. That is the measured direct
+-- shape applied to the gateway leg; a 404 through the gateway after
+-- `PROVIDER_KEY_GROK` is set is the cheap way to learn it was wrong, the same
+-- discovery 0063 made for Google.
+--
+-- `base_url` is deliberately not set: it is per upstream and would yank the
+-- chat rows off `/compat` (0063). `provider_path_prefix` is safe to set: only
+-- `providerPath` in `src/route-run.ts` reads it (images, speech, embeddings).
+-- Chat hard-codes `/compat/chat/completions` in `src/chat.ts` and never
+-- consults this column — same fact 0063 recorded for Google.
+--
+-- Capability flags stay NULL. Conformance is the only writer, and a
+-- component-priced image run measures generation only — not usage tokens, not
+-- a nine-cell grid — because neither is a property of this bill.
+UPDATE upstreams SET provider_path_prefix = '/v1' WHERE id = 'grok';
+
+INSERT INTO models (id, upstream_id, upstream_model, modality, priced_by,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('grok/grok-imagine-image',         'grok', 'grok-imagine-image',         'image', 'component',
+   'retained', 'https://docs.x.ai/developers/faq/security', '2026-09-05'),
+  ('grok/grok-imagine-image-quality', 'grok', 'grok-imagine-image-quality', 'image', 'component',
+   'retained', 'https://docs.x.ai/developers/faq/security', '2026-09-05'),
+  ('grok/grok-imagine-image-2.0',     'grok', 'grok-imagine-image-2.0',     'image', 'component',
+   'retained', 'https://docs.x.ai/developers/faq/security', '2026-09-05');
+
+INSERT INTO price_components
+  (observed_at, model, effective_from, component, variant, micros, per, source, note)
+VALUES
+  ('2026-09-13 00:00:00', 'grok/grok-imagine-image', '2026-09-13', 'image', '',
+    20000, 1, 'https://docs.x.ai/developers/models/grok-imagine-image',
+   'First observation: $0.02 per image, flat. Measured response usage.cost_in_usd_ticks = 200000000 on 2026-09-13.'),
+  ('2026-09-13 00:00:00', 'grok/grok-imagine-image-quality', '2026-09-13', 'image', '',
+    50000, 1, 'https://docs.x.ai/developers/models/grok-imagine-image-quality',
+   'First observation: $0.05 per image, flat. Measured response usage.cost_in_usd_ticks = 500000000 on 2026-09-13.'),
+  ('2026-09-13 00:00:00', 'grok/grok-imagine-image-2.0', '2026-09-13', 'image', '',
+    40000, 1, 'https://docs.x.ai/developers/models/grok-imagine-image-2.0',
+   'First observation: $0.04 per image, flat. Measured response usage.cost_in_usd_ticks = 400000000 on 2026-09-13.');

package/migrations/0082_markup_three_percent.sql

@@ -0,0 +1,32 @@
+-- The platform default markup falls from 10% to 3% (#463, dashboard epic
+-- dashboard#620).
+--
+-- Why: BytesBrains' published price becomes "a 3% markup on usage", charged
+-- as a request is served. Payment-gateway fees are the dashboard's, shown at the
+-- payment step, and never pass through Cruise — so the markup is the whole of
+-- Cruise's margin and the whole of what the pricing page states. The dashboard's
+-- copy change (dashboard#625) is held until production charges
+-- this, because advertising 3% while charging 10% is a false price.
+--
+-- A new row, not an edit of 0033's: sell_markups is dated like a price, so a
+-- request settled before this date keeps the 10% it was charged, and a
+-- statement or reconciliation re-derived later still finds that basis.
+--
+-- What it changes, and what it does not:
+--
+--   * Only `'*'`. A tenant with a row of its own keeps its own rate — the
+--     resolution in `markupInForce` prefers the tenant's row however dated.
+--   * Only billed tenants. Internal tenants and the conformance runner are
+--     charged list and never read this table.
+--   * The rate is read twice per request, at reservation and at settlement,
+--     each at its own moment. A request reserved before 00:00 UTC on the day
+--     and settled after is held at 10% and charged 3%; the difference is
+--     released, so a cap is never breached by a fall. (A rise would settle
+--     above its hold by the difference — #464's concern, not this row's.)
+--   * A cache hit is the published fraction of list with the markup on top:
+--     20% of list, then plus 3%.
+--
+-- Dated 2026-09-16 (UTC), agreed for #463 on 2026-09-15. Mid-month, so a
+-- September statement's `markup` field names the rate in force on its last
+-- day — 3% — while its lines carry each row as charged, 10% and 3% both.
+INSERT INTO sell_markups (tenant_id, effective_from, basis_points) VALUES ('*', '2026-09-16', 300);

package/migrations/0083_markup_per_tenant_and_tier.sql

@@ -0,0 +1,57 @@
+-- A markup per tenant and per tier, set over the wire (#464, dashboard epic
+-- dashboard#620).
+--
+-- Why: 0033 made the markup a dated per-tenant row and said a tier "is a policy
+-- that writes these rows". Nothing ever wrote one — no route, no command — so a
+-- deal for one customer was a migration, and #463's platform default was the
+-- only lever that moved. Staff now set a rate per account and per tier from
+-- the dashboard's admin panel, through `/payments/markup/*`.
+--
+-- Resolution is one order, in `markupInForce`: the tenant's own row, then its
+-- tier's, then the platform's `'*'` — each the latest row not after the day.
+--
+-- 1. `sell_markups.basis_points` may be NULL, on a tenant row only. A NULL row
+--    means "no rate of its own from this date": it supersedes the tenant's
+--    earlier rows and resolution falls through to the tier. Clearing an
+--    override is a new dated row, never a delete, so a month charged at the
+--    override still finds it. `'*'` cannot be cleared — a billed tenant charged
+--    0% because the default went missing is 0033's reason for seeding one.
+--
+--    SQLite cannot relax NOT NULL or add a table CHECK in place, so the table
+--    is rebuilt. Nothing references it: no view, no trigger, no foreign key.
+--
+-- 2. `tier_markups`, a table of its own rather than `'tier:pro'` rows in
+--    `sell_markups`: a tier id is not a tenant id, and one column meaning two
+--    things is how a lookup for one comes to match the other. Not seeded — a
+--    tier with no row resolves to the platform default, so this migration
+--    changes no charge.
+--
+-- What is not dated: `tenants.tier` holds the tier a tenant is on now. A tenant
+-- that moves tier is charged the new tier's rate from its next request, and a
+-- past month's statement names the rate of the tier held today. Each ledger row
+-- carries what its request was actually charged, so the month's lines are exact
+-- either way.
+CREATE TABLE sell_markups_new (
+  tenant_id      TEXT NOT NULL,
+  effective_from TEXT NOT NULL,
+  -- Above list, in basis points: 300 is list plus 3%. NULL clears a tenant's
+  -- own rate from this date.
+  basis_points   INTEGER CHECK (basis_points IS NULL OR basis_points BETWEEN 0 AND 10000),
+  recorded_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (tenant_id, effective_from),
+  CHECK (tenant_id <> '*' OR basis_points IS NOT NULL)
+);
+
+INSERT INTO sell_markups_new (tenant_id, effective_from, basis_points, recorded_at)
+SELECT tenant_id, effective_from, basis_points, recorded_at FROM sell_markups;
+
+DROP TABLE sell_markups;
+ALTER TABLE sell_markups_new RENAME TO sell_markups;
+
+CREATE TABLE tier_markups (
+  tier_id        TEXT NOT NULL REFERENCES tiers (id),
+  effective_from TEXT NOT NULL,
+  basis_points   INTEGER NOT NULL CHECK (basis_points BETWEEN 0 AND 10000),
+  recorded_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (tier_id, effective_from)
+);

package/migrations/0084_coding_lanes_frontier.sql

@@ -0,0 +1,93 @@
+-- Restaff the four coding lanes with each lab's best coding model.
+--
+-- bb/agentic-coding, bb/builder, bb/hunter and bb/code-review had drifted
+-- into a cheap pool: DeepSeek Flash at quality_rank 1 on all four, beside
+-- qwen3.8-27b, gpt-oss-120b and mistral-medium. That clears the ≥3-routable
+-- bar and is not what a caller naming a coding lane is asking for. 0075
+-- left the Claude 5 rows out because `measured_at` was null; they have since
+-- measured clean (below), so the reason is gone.
+--
+-- ## One lab, its best coding model
+--
+-- The team is the strongest tools-capable coding model each lab we buy from
+-- directly (upstreams.md) has in the catalogue. Every member is tools=1 —
+-- all four lanes are `tools-required`, and a tools=0 member never allocates.
+--
+--   Anthropic  claude-fable-5-1, claude-opus-5   rank 1
+--   Google     gemini-3.1-pro-preview            rank 2
+--   xAI        grok-4.6                          rank 2
+--   Moonshot   kimi-k2.7-code (Workers AI)       rank 2 (hunter: kimi-k2.6, as 0075)
+--   Zhipu      glm-5.3 (Workers AI)              rank 3
+--   Mistral    codestral-2508                    rank 3 (hunter / code-review:
+--                                                mistral-medium-2604 — coding
+--                                                polish invents plausible vulns, 0074)
+--
+-- Anthropic carries two at rank 1 on purpose: Fable 5.1 and Opus 5 are the
+-- two strongest coding models in the catalogue, and graduated splits rank-1
+-- peers equally. Sonnet 5 is not added — Opus 5 is above it at the same job.
+--
+-- ## Who is absent, and why
+--
+--   openai/gpt-6-astra      measured tools=0: chat-completions refuses function
+--                           tools alongside reasoning_effort (0078). The best
+--                           OpenAI model cannot join a tools-required lane until
+--                           the probe or a Responses path measures tools honestly.
+--   deepseek/deepseek-flash DeepSeek's only live chat row since V4-Pro retired
+--                           (0076); a flash model is not a frontier coder.
+--                           Returns when a V4.1-Pro ships and is measured.
+--   workers-ai gpt-oss-120b, qwen3.8-27b, gemini-3.8-flash — mid-tier, and each
+--                           lab above already has a stronger member here.
+--
+-- ## What to check before applying to an environment
+--
+-- Measured on staging (UTC): claude-* 2026-09-12, grok-4.6 2026-09-10 —
+-- tools, streaming and usage all 1. Production was not read when this was
+-- written. An unmeasured member is refused per request rather than served,
+-- but it nulls the lane's folded capabilities in `/v1/models` (lanes.ts), so
+-- confirm `measured_at` and `tools = 1` on production for those five rows
+-- first.
+--
+-- Streaming: gemini-3.1-pro-preview and kimi-k2.6 measure streaming=0 and
+-- glm-5.3 null, so a `stream: true` request is served from the other members.
+--
+-- data_retention: gemini and grok rows are NULL (#454), so once #450 is
+-- deployed a billed tenant is refused them and drawn from the rest.
+--
+-- Selection policy is unchanged on every lane: builder and hunter stay
+-- `graduated`, agentic-coding and code-review stay as they are.
+
+DELETE FROM lane_members
+ WHERE lane_id IN ('bb/agentic-coding', 'bb/builder', 'bb/hunter', 'bb/code-review');
+
+INSERT INTO lane_members (lane_id, model_id, position, quality_rank) VALUES
+  ('bb/agentic-coding', 'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/agentic-coding', 'anthropic/claude-opus-5',                   2, 1),
+  ('bb/agentic-coding', 'google-ai-studio/gemini-3.1-pro-preview',   3, 2),
+  ('bb/agentic-coding', 'grok/grok-4.6',                             4, 2),
+  ('bb/agentic-coding', 'workers-ai/@cf/moonshotai/kimi-k2.7-code',  5, 2),
+  ('bb/agentic-coding', 'workers-ai/@cf/zai-org/glm-5.3',            6, 3),
+  ('bb/agentic-coding', 'mistral/codestral-2508',                    7, 3),
+
+  ('bb/builder',        'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/builder',        'anthropic/claude-opus-5',                   2, 1),
+  ('bb/builder',        'google-ai-studio/gemini-3.1-pro-preview',   3, 2),
+  ('bb/builder',        'grok/grok-4.6',                             4, 2),
+  ('bb/builder',        'workers-ai/@cf/moonshotai/kimi-k2.7-code',  5, 2),
+  ('bb/builder',        'workers-ai/@cf/zai-org/glm-5.3',            6, 3),
+  ('bb/builder',        'mistral/codestral-2508',                    7, 3),
+
+  ('bb/hunter',         'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/hunter',         'anthropic/claude-opus-5',                   2, 1),
+  ('bb/hunter',         'google-ai-studio/gemini-3.1-pro-preview',   3, 2),
+  ('bb/hunter',         'grok/grok-4.6',                             4, 2),
+  ('bb/hunter',         'workers-ai/@cf/moonshotai/kimi-k2.6',       5, 2),
+  ('bb/hunter',         'workers-ai/@cf/zai-org/glm-5.3',            6, 3),
+  ('bb/hunter',         'mistral/mistral-medium-2604',               7, 3),
+
+  ('bb/code-review',    'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/code-review',    'anthropic/claude-opus-5',                   2, 1),
+  ('bb/code-review',    'google-ai-studio/gemini-3.1-pro-preview',   3, 2),
+  ('bb/code-review',    'grok/grok-4.6',                             4, 2),
+  ('bb/code-review',    'workers-ai/@cf/moonshotai/kimi-k2.7-code',  5, 2),
+  ('bb/code-review',    'workers-ai/@cf/zai-org/glm-5.3',            6, 3),
+  ('bb/code-review',    'mistral/mistral-medium-2604',               7, 3);

package/migrations/0085_minute_period_and_demo_charge.sql

@@ -0,0 +1,77 @@
+-- A budget that trips on the demo, for free, and heals itself (#494).
+--
+-- The hard stop tripping mid-run is the one thing Cruise does that a
+-- gateway does not, and the demo could only show its headers. Every demo
+-- price is zero (demo-catalogue.ts), so `x-cruise-budget-spend` never moved
+-- off 0.0000 and the cap was unreachable. A public sample
+-- (bytesbrains/cruise-agentgateway) had to drop the cap from its v0 for
+-- exactly that reason.
+--
+-- Two columns change, and both are needed:
+--
+--   `period` admits 'minute'. A published key is shared by every stranger
+--   who runs the sample, so a tiny cap on a daily period is taken down for
+--   everyone by the first person to trip it, until midnight UTC. That trap
+--   is named in #494 itself. A minute is the shortest window that still fits
+--   a run of a handful of calls, and it means `retry-after` is never more
+--   than 60 seconds. It is set only on the demo: `budget:set` refuses
+--   `--period minute` for any other `--env`, and the control plane still
+--   accepts day or month only. A minute window is one `spend` row per project
+--   per minute, which is fine for one demo project and not a dial to hand to
+--   customers.
+--
+--   `demo_charge_micros` is a flat charge per served request. Catalogue prices
+--   stay zero on purpose: #327 decided that, `catalogue_parity` compares
+--   against production, and a real price would let a no-max_tokens request
+--   on a dear model reserve more than a demo tenant's $5. So the cost comes
+--   from the project instead of the model. Only the one project that publishes
+--   the cap has a non-zero value, and every other demo tenant still reads
+--   0.0000. It is honoured only in CREDENTIAL_FREE_ENVIRONMENTS
+--   (`src/demo-charge.ts`). On production the column is never read, so a value
+--   that got there by hand bills nobody.
+--
+-- CHECK constraints cannot be altered in SQLite, so both tables are rebuilt,
+-- the same way 0035 built them. Nothing references either table by foreign
+-- key, and neither has an index or trigger to recreate.
+CREATE TABLE budgets_new (
+  scope   TEXT NOT NULL CHECK (scope IN ('project', 'tenant')),
+  subject TEXT NOT NULL,
+  period  TEXT NOT NULL DEFAULT 'day' CHECK (period IN ('minute', 'day', 'month', 'lifetime')),
+  soft_micros INTEGER,
+  hard_micros INTEGER,
+  reserve_micros INTEGER NOT NULL DEFAULT 50000,
+  overdraft_micros INTEGER NOT NULL DEFAULT 0 CHECK (overdraft_micros >= 0),
+  -- Charged on every 2xx, on top of what the usage cost, and reserved with
+  -- the bound so that the cap refuses at the reservation rather than
+  -- overshooting at settlement. Zero everywhere but the demo's cap project.
+  demo_charge_micros INTEGER NOT NULL DEFAULT 0 CHECK (demo_charge_micros >= 0),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_by TEXT,
+  PRIMARY KEY (scope, subject),
+  CHECK ((scope = 'tenant') = (period = 'lifetime'))
+);
+
+INSERT INTO budgets_new (scope, subject, period, soft_micros, hard_micros, reserve_micros, overdraft_micros, updated_at, updated_by)
+SELECT scope, subject, period, soft_micros, hard_micros, reserve_micros, overdraft_micros, updated_at, updated_by
+  FROM budgets;
+DROP TABLE budgets;
+ALTER TABLE budgets_new RENAME TO budgets;
+
+CREATE TABLE spend_new (
+  scope         TEXT NOT NULL CHECK (scope IN ('project', 'tenant')),
+  subject       TEXT NOT NULL,
+  period        TEXT NOT NULL CHECK (period IN ('minute', 'day', 'month', 'lifetime')),
+  -- '' for lifetime. `YYYY-MM-DD HH:MM` for a minute, which is what
+  -- strftime('%Y-%m-%d %H:%M', 'now') gives (`src/budget.ts`).
+  period_start  TEXT NOT NULL,
+  spend_micros  INTEGER NOT NULL DEFAULT 0,
+  request_count INTEGER NOT NULL DEFAULT 0,
+  updated_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (scope, subject, period, period_start)
+);
+
+INSERT INTO spend_new (scope, subject, period, period_start, spend_micros, request_count, updated_at)
+SELECT scope, subject, period, period_start, spend_micros, request_count, updated_at
+  FROM spend;
+DROP TABLE spend;
+ALTER TABLE spend_new RENAME TO spend;

package/migrations/0086_project_sentry.sql

@@ -0,0 +1,41 @@
+-- A project's own Sentry, as a destination the tenant chose (#506, epic #508).
+--
+-- Why: Cruise's answers that change what a tenant's app gets (a budget crossing
+-- its soft threshold, the hard stop, a wallet running low) reach the app today as
+-- a status code in its own logs, if it logs them. #506 sends them as issues into
+-- the tenant's own Sentry project, next to their errors. This migration is the
+-- half that stores where; nothing sends yet.
+--
+-- Per project, not per tenant: a Cruise project is an app, and so is a Sentry
+-- project, and budgets are per project already. Keyed by project alone, so the
+-- tenant is reached one way only, through `projects.tenant_id` (0004's rule).
+--
+-- A table of its own rather than a column on `projects`, so no reader of
+-- `projects` (the listing, the doctor, a `SELECT *` in a script) can carry the
+-- key along by accident.
+--
+-- The DSN is stored split. `endpoint` is everything but the key:
+-- scheme://host[:port][/prefix]/<sentry project id>. It is what the control
+-- plane returns and what the audit trail records, so a trail can say which
+-- Sentry project a change pointed at without holding the credential.
+-- `public_key` is the part that authorises sending. Sentry calls it public,
+-- because a DSN ships in browser bundles and grants nothing but ingest, but it
+-- is the tenant's credential all the same: never returned, logged or audited.
+--
+-- Not encrypted at rest. The worst a leaked key does is send events into the
+-- tenant's own Sentry project, which rotating the DSN in Sentry ends, and a
+-- key for Cruise to encrypt with would be a new secret per environment
+-- guarding less than it costs. Revisit if a stored credential here ever grants
+-- more than ingest.
+--
+-- Clearing sets both columns NULL rather than deleting the row, so the columns
+-- #506 adds next (the last state sent, per event kind) survive a DSN being
+-- switched off and on.
+CREATE TABLE project_sentry (
+  project_id TEXT PRIMARY KEY REFERENCES projects (id),
+  endpoint   TEXT,
+  public_key TEXT,
+  updated_by TEXT NOT NULL,
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  CHECK ((endpoint IS NULL) = (public_key IS NULL))
+);

package/migrations/0087_lane_router.sql

@@ -0,0 +1,71 @@
+-- A lane can ask a router which member should serve, before it draws (#531).
+--
+-- Every selection policy so far (0065, 0067) decides from what Cruise already
+-- knows: price, health, a weight, a declared rank. None of them reads the
+-- request, so a one-line typo fix and a rewrite of the auth middleware reach
+-- the same member of `bb/code-review` with the same odds. #531 asks for the
+-- other thing: hand a router the request and the lane's members, and let it
+-- say which one this request needs. The router it names is Jev (TypeSafe AI),
+-- a model that returns a typed choice and a calibrated probability per option
+-- rather than prose, in a few hundred milliseconds.
+--
+-- ── Why this is not a fifth selection policy ─────────────────────────────────
+--
+-- The obvious shape is `selection_policy = 'jev'`, and it is wrong twice.
+--
+-- **The CHECK.** Three constraints enumerate the policies, SQLite cannot alter
+-- a CHECK, and 0067 records at length why neither a table rebuild nor a column
+-- swap is safe on D1. A fifth value would be a second expand-and-contract over
+-- `lanes`, `ledger` and `tenants` to add one word.
+--
+-- **The meaning.** A router can fail — no credential, a timeout, an answer it
+-- is not confident of, a request with nothing to route on — and a lane that
+-- fails *to choose* must still serve. So the router needs a fallback, and the
+-- fallback is exactly what `selection_policy` already is. Layering the router
+-- over the policy says that in the schema: Jev picks the head when it can, and
+-- the lane's own policy runs when it cannot. A router that replaced the policy
+-- would need its fallback stored somewhere else anyway.
+--
+-- So: two columns beside the policy, both new, both pure adds — the one shape
+-- of schema change 0067 found to have no window.
+--
+-- ── What goes to the router ──────────────────────────────────────────────────
+--
+-- `router_input` exists because TypeSafe is a new party that sees request
+-- data, and how much it sees is a privacy decision the lane's owner makes, not
+-- a default we pick for them (decided on #531).
+--
+--   hint    (default) only the caller's `x-cruise-route-hint` header — what the
+--           issue's own example sends: an issue type, an intent, a diff
+--           summary. No prompt text leaves Cruise. A request without a hint
+--           is not routed; the lane's policy draws.
+--   prompt  the hint if any, plus the last user message, truncated. What a
+--           stock client that cannot set headers needs, and an explicit
+--           opt-in because it sends prompt content to a sub-processor.
+--
+-- An operator's terms should list it beside the model hosts.
+--
+-- ── The ledger ───────────────────────────────────────────────────────────────
+--
+-- `ledger.router` names the router a lane consulted (NULL when it had none),
+-- `router_outcome` what came of it, and `router_confidence` the probability
+-- Jev put on its choice when it made one. The outcome is recorded on the
+-- fallbacks too, because "the router ran and was ignored 80% of the time" is
+-- the finding that says whether it earns its latency, and it is invisible if
+-- only the successes are kept. The confidence is kept for the same reason
+-- `quality_rank` was declared before it was measured: a threshold is a guess
+-- until the ledger can show what each confidence band went on to complete.
+--
+-- **Deploy order is migrate first, then the Worker**, as for every add.
+
+ALTER TABLE lanes ADD COLUMN router TEXT
+  CHECK (router IS NULL OR router IN ('jev'));
+ALTER TABLE lanes ADD COLUMN router_input TEXT NOT NULL DEFAULT 'hint'
+  CHECK (router_input IN ('hint', 'prompt'));
+
+ALTER TABLE ledger ADD COLUMN router TEXT
+  CHECK (router IS NULL OR router IN ('jev'));
+ALTER TABLE ledger ADD COLUMN router_outcome TEXT
+  CHECK (router_outcome IS NULL OR router_outcome IN
+         ('chose', 'low_confidence', 'failed', 'malformed', 'no_input', 'unconfigured', 'bypassed'));
+ALTER TABLE ledger ADD COLUMN router_confidence REAL;

package/migrations/0088_openai_frontier_coding_lanes.sql

@@ -0,0 +1,54 @@
+-- Support tool calling for OpenAI frontier reasoning models and restaff coding lanes (#545).
+--
+-- Prior to #545, OpenAI's newer reasoning models (gpt-6-astra, gpt-5.6-*) refused
+-- function tools on the legacy /v1/chat/completions endpoint ("use /v1/responses
+-- or set reasoning_effort to 'none'"). With Cruise's /v1/responses route and
+-- translation adapter in place, tool calling is now measured and served natively.
+--
+-- Promotes openai/gpt-6-astra (quality_rank 1) and openai/gpt-5.6-sol (quality_rank 2)
+-- into bb/agentic-coding, bb/builder, bb/hunter, and bb/code-review alongside Claude 5
+-- and Gemini 3.1 Pro now that /v1/responses route & adapter allows honest tool measurement.
+
+DELETE FROM lane_members
+ WHERE lane_id IN ('bb/agentic-coding', 'bb/builder', 'bb/hunter', 'bb/code-review');
+
+INSERT INTO lane_members (lane_id, model_id, position, quality_rank) VALUES
+  ('bb/agentic-coding', 'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/agentic-coding', 'anthropic/claude-opus-5',                   2, 1),
+  ('bb/agentic-coding', 'openai/gpt-6-astra',                        3, 1),
+  ('bb/agentic-coding', 'google-ai-studio/gemini-3.1-pro-preview',   4, 2),
+  ('bb/agentic-coding', 'openai/gpt-5.6-sol',                        5, 2),
+  ('bb/agentic-coding', 'grok/grok-4.6',                             6, 2),
+  ('bb/agentic-coding', 'workers-ai/@cf/moonshotai/kimi-k2.7-code',  7, 2),
+  ('bb/agentic-coding', 'workers-ai/@cf/zai-org/glm-5.3',            8, 3),
+  ('bb/agentic-coding', 'mistral/codestral-2508',                    9, 3),
+
+  ('bb/builder',        'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/builder',        'anthropic/claude-opus-5',                   2, 1),
+  ('bb/builder',        'openai/gpt-6-astra',                        3, 1),
+  ('bb/builder',        'google-ai-studio/gemini-3.1-pro-preview',   4, 2),
+  ('bb/builder',        'openai/gpt-5.6-sol',                        5, 2),
+  ('bb/builder',        'grok/grok-4.6',                             6, 2),
+  ('bb/builder',        'workers-ai/@cf/moonshotai/kimi-k2.7-code',  7, 2),
+  ('bb/builder',        'workers-ai/@cf/zai-org/glm-5.3',            8, 3),
+  ('bb/builder',        'mistral/codestral-2508',                    9, 3),
+
+  ('bb/hunter',         'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/hunter',         'anthropic/claude-opus-5',                   2, 1),
+  ('bb/hunter',         'openai/gpt-6-astra',                        3, 1),
+  ('bb/hunter',         'google-ai-studio/gemini-3.1-pro-preview',   4, 2),
+  ('bb/hunter',         'openai/gpt-5.6-sol',                        5, 2),
+  ('bb/hunter',         'grok/grok-4.6',                             6, 2),
+  ('bb/hunter',         'workers-ai/@cf/moonshotai/kimi-k2.6',       7, 2),
+  ('bb/hunter',         'workers-ai/@cf/zai-org/glm-5.3',            8, 3),
+  ('bb/hunter',         'mistral/mistral-medium-2604',               9, 3),
+
+  ('bb/code-review',    'anthropic/claude-fable-5-1',                1, 1),
+  ('bb/code-review',    'anthropic/claude-opus-5',                   2, 1),
+  ('bb/code-review',    'openai/gpt-6-astra',                        3, 1),
+  ('bb/code-review',    'google-ai-studio/gemini-3.1-pro-preview',   4, 2),
+  ('bb/code-review',    'openai/gpt-5.6-sol',                        5, 2),
+  ('bb/code-review',    'grok/grok-4.6',                             6, 2),
+  ('bb/code-review',    'workers-ai/@cf/moonshotai/kimi-k2.7-code',  7, 2),
+  ('bb/code-review',    'workers-ai/@cf/zai-org/glm-5.3',            8, 3),
+  ('bb/code-review',    'mistral/mistral-medium-2604',               9, 3);

package/migrations/0089_agentic_coding_drops_codestral.sql

@@ -0,0 +1,44 @@
+-- Take codestral-2508 out of the two lanes Claude Code drives (#549).
+--
+-- On 2026-09-29 (17:59–18:08 UTC) every request Claude Code sent to
+-- `bb/agentic-coding` in production was served by `mistral/codestral-2508` —
+-- five requests, 32,284 completion tokens, all under the lane's `cheap` policy,
+-- which takes the cheapest routable member and codestral is it. What came back:
+-- one sentence repeated to the output limit ("Please confirm if this approach
+-- is acceptable"), and a tool call named
+-- `mcp__plugin_cruise_cruise__list_models{"kind": "all"}`, the arguments fused
+-- onto the name, which Claude Code refused as "No such tool available".
+--
+-- Codestral is Mistral's completion model — fill-in-the-middle, short
+-- contexts — and it measures tools = 1 because the conformance probe asks for
+-- one call to one tool with one sentence of context. A Claude Code turn is a
+-- long system prompt and dozens of tools, which it does not hold together.
+-- 0084 picked it as "Mistral's best coding model"; for completion that is
+-- right, for an agent it is not. It stays in `bb/code-completion`.
+--
+-- Mistral's seat goes to `mistral-medium-2604`, the model hunter and
+-- code-review already hold there (0084), at the same rank and position.
+-- Devstral would be the natural pick and is not in the catalogue.
+--
+-- The tool check now fails a call whose name is not an offered tool or whose
+-- arguments are not a JSON object (`src/conformance-tools.ts`), so the malformed
+-- shape measures tools = 0 for any model that produces it on the probe. The
+-- probe is still one short turn, so that is a floor, not a Claude Code test.
+--
+-- Selection policy is unchanged.
+--
+-- Two statements, not one. `lane_members` is keyed (lane_id, model_id) and the
+-- control plane can rewrite a lane's members (`src/lanes-write.ts`), so an
+-- environment where mistral-medium was already added to either lane would
+-- fail a bare UPDATE on the primary key and stop the migration with codestral
+-- still serving. OR IGNORE skips that row and the DELETE takes codestral out
+-- either way; on the rows 0088 wrote, the DELETE matches nothing.
+
+UPDATE OR IGNORE lane_members
+   SET model_id = 'mistral/mistral-medium-2604'
+ WHERE lane_id IN ('bb/agentic-coding', 'bb/builder')
+   AND model_id = 'mistral/codestral-2508';
+
+DELETE FROM lane_members
+ WHERE lane_id IN ('bb/agentic-coding', 'bb/builder')
+   AND model_id = 'mistral/codestral-2508';