@claudexor/orchestrator 2.1.2 → 2.1.3

package/dist/orchestrator.js

@@ -1,6 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
-import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, } from "./credential-profiles.js";
+import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, } from "./credential-profiles.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
+import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
+import { processAttemptUsage } from "./attemptUsage.js";
+import { toCandidateEvidence } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
@@ -31,7 +34,7 @@ import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, revalidateFindings, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, usageCostSettlement, rankHarnesses, } from "@claudexor/budget";
+import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
 import { appendLine, assertNoInlineSecretValues, containsSecretLikeToken, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
@@ -334,29 +337,6 @@ export class Orchestrator {
         const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
         return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
     }
-    /** null = no profile selected (default verdict stands); "available" = the
-     * profile's own probe admits the route; any other string = typed refusal. */
-    async profileAvailabilityOverride(input, harnessId) {
-        if (!input.credentialProfileId)
-            return null;
-        let profile;
-        try {
-            profile = this.resolveCredentialProfile(input, harnessId);
-        }
-        catch (err) {
-            return err instanceof Error ? err.message : String(err);
-        }
-        if (!profile)
-            return null;
-        const adapter = this.deps.registry.get(harnessId);
-        if (!adapter?.probeCredentialProfile) {
-            return `harness "${harnessId}" has no profile probe`;
-        }
-        const probe = await adapter.probeCredentialProfile(profile);
-        if (probe.availability === "available")
-            return "available";
-        return probe.detail ?? `${probe.availability}/${probe.verification}`;
-    }
     preflightProfile(input, harnessId, log) {
         const profile = this.resolveCredentialProfile(input, harnessId);
         const policy = this.profilePolicy(input.repoRoot, harnessId);
@@ -537,9 +517,7 @@ export class Orchestrator {
                 dropped.push(`${id} (unavailable)`);
                 continue;
             }
-            // Doctor status is the readiness truth: auto-pools take only doctor-OK
-            // routes, and explicitly selecting an UNAVAILABLE harness fails loudly
-            // with the doctor's reasons. A DEGRADED harness (e.g. key present but
+            // Doctor status is the readiness truth. A DEGRADED harness (e.g. key present but
             // unproven by isolated smoke) is admitted only by explicit user
             // selection — degraded means usable-with-caveats, and the caveats are
             // visible in doctor output and run events.
@@ -550,34 +528,40 @@ export class Orchestrator {
             // the profile's transport, so the default store's state is not the
             // routing truth). Capability/manifest gating above still applies.
             let profileAdmitted = false;
-            if (status.status !== "ok") {
-                const profileVerdict = await this.profileAvailabilityOverride(input, id);
+            const profileAdapter = this.deps.registry.get(id);
+            const profileVerdict = await selectedProfileAvailability({
+                registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
+                profileId: input.credentialProfileId,
+                harnessId: id,
+                probe: profileAdapter?.probeCredentialProfile?.bind(profileAdapter),
+            });
+            if (profileVerdict !== null) {
                 if (profileVerdict === "available") {
-                    // The default-store failure may have zeroed enabled_intents; with
-                    // the profile probe as the auth verdict, MANIFEST capabilities are
-                    // the honest intent truth (degraded = usable-with-caveats).
-                    status = {
-                        ...status,
-                        status: "degraded",
-                        enabledIntents: capabilityIntents(manifest.capabilities),
-                    };
-                    statusById.set(id, status);
                     profileAdmitted = true;
+                    // A valid profile restores manifest intent truth when the default store failed.
+                    if (status.status !== "ok") {
+                        status = {
+                            ...status,
+                            status: "degraded",
+                            enabledIntents: capabilityIntents(manifest.capabilities),
+                        };
+                        statusById.set(id, status);
+                    }
                 }
-                else if (profileVerdict !== null) {
+                else {
                     const why = `${id} credential profile is not ready: ${profileVerdict}`;
                     if (explicitPool)
                         throw new HarnessUnavailableError(why);
                     dropped.push(why);
                     continue;
                 }
-                else if (status.status === "unavailable") {
-                    const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
-                    if (explicitPool)
-                        throw new HarnessUnavailableError(why);
-                    dropped.push(why);
-                    continue;
-                }
+            }
+            if (status.status === "unavailable" && !profileAdmitted) {
+                const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
+                if (explicitPool)
+                    throw new HarnessUnavailableError(why);
+                dropped.push(why);
+                continue;
             }
             if (status.status !== "ok" && !explicitPool && !profileAdmitted) {
                 dropped.push(`${id} is ${status.status}${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`);
@@ -1089,12 +1073,10 @@ export class Orchestrator {
             ignored,
         };
     }
-    /** Run one candidate inside an already-created envelope. Never creates/disposes the envelope. */
-    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false) {
+    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false, fileBackedContext) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
-        // In-place envelopes can resume native sessions; isolated scoped homes cannot,
-        // so their session ids are never retained after disposal.
+        // Isolated scoped-home sessions are never retained after disposal.
         const inPlaceEnvelope = envelope.worktree_path === envelope.repo_root;
         const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
         const sessionFields = runInput ? this.sessionSpecFields(runInput, adapter.id, log) : undefined;
@@ -1163,6 +1145,7 @@ export class Orchestrator {
         }
         try {
             for (let nativeTry = 0; !signal?.aborted; nativeTry += 1) {
+                const clearFileBackedContext = stageFileBackedContext(envelope.worktree_path, fileBackedContext);
                 const runSpec = nativeTry === 0
                     ? spec
                     : HarnessRunSpec.parse({ ...spec, session_id: newId("ses"), extra: { ...spec.extra } });
@@ -1238,31 +1221,23 @@ export class Orchestrator {
                                 items: safeEv.plan_progress.items,
                             });
                         }
-                        if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
-                            cost += safeEv.usage.cost_usd;
-                            if (safeEv.usage.estimated)
-                                costEstimated = true;
-                            log?.emit("budget.observation", {
-                                harness_id: adapter.id,
-                                attempt_id: attemptId,
-                                kind: "spend",
-                                usd: safeEv.usage.cost_usd,
-                                estimated: safeEv.usage.estimated === true,
+                        if (safeEv.type === "usage") {
+                            const usage = processAttemptUsage({
+                                event: safeEv,
+                                telemetry,
+                                harnessId: adapter.id,
+                                attemptId,
+                                cost,
+                                costEstimated,
+                                emit: (type, payload) => log?.emit(type, payload),
+                                budgetGuard,
+                                cancel: () => void adapter.cancel?.(runSpec.session_id)?.catch(() => { }),
                             });
-                            // Mid-flight cap enforcement: the guard raises this attempt's hold
-                            // to the streamed cost; a hard tier aborts NOW instead of letting a
-                            // streaming candidate overshoot the paid budget until settlement.
-                            const valuationOnly = safeEv.usage.estimated === true && telemetry.authMode === "local_session";
-                            if (!valuationOnly && budgetGuard?.(cost)) {
+                            cost = usage.cost;
+                            costEstimated = usage.costEstimated;
+                            if (usage.hardCapReached) {
                                 harnessErrored = true;
                                 errors.push("budget hard cap reached mid-attempt; stream aborted");
-                                log?.emit("budget.observation", {
-                                    harness_id: adapter.id,
-                                    attempt_id: attemptId,
-                                    kind: "cooldown",
-                                    detail: "hard cap mid-flight abort",
-                                });
-                                void adapter.cancel?.(runSpec.session_id)?.catch(() => { });
                                 break;
                             }
                         }
@@ -1293,6 +1268,9 @@ export class Orchestrator {
                     harnessErrored = true;
                     errors.push(safeErrorMessage(err));
                 }
+                finally {
+                    clearFileBackedContext();
+                }
                 const transient = telemetry.transientFailures.at(-1) ?? null;
                 const sawTransient = telemetry.transientFailures.length > transientStart;
                 const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
@@ -1416,9 +1394,6 @@ export class Orchestrator {
             // must carry it so the slot catch settles the TRUE cost, not 0.
             throw Object.assign(err instanceof Error ? err : new Error(String(err)), { costUsd: cost });
         }
-        store.writeText(join(attemptDir, "patch.diff"), diff);
-        // Routing metrics (one owner in runSupport; clean attempts only —
-        // auth-route evidence recorded regardless).
         recordCleanAttemptMetrics(globalConfigDir(), adapter.id, {
             costUsd: cost,
             streamMs: attemptStreamEndedMs - attemptStartedMs,
@@ -1426,26 +1401,25 @@ export class Orchestrator {
             aborted: signal?.aborted === true,
             authMode: telemetry.authMode,
         });
-        const attemptDiffstat = diffStats(diff);
-        store.writeYaml(join(attemptDir, "attempt.yaml"), {
-            attempt_id: attemptId,
-            harness_id: adapter.id,
-            label,
-            cost_usd: cost,
-            cost_estimated: costEstimated,
-            errored,
-            errors: errors.slice(0, 5),
-            ...telemetrySummary(telemetry),
-            outcome: telemetry.outcome,
-            gates: gates.map((g) => ({ id: g.id, status: g.status })),
-            // Candidate-card evidence: the Candidates tab renders per-attempt
-            // diffstat without re-parsing patch bytes client-side.
-            diffstat: {
-                files: attemptDiffstat.paths.length,
-                additions: attemptDiffstat.additions,
-                deletions: attemptDiffstat.deletions,
+        const producedFiles = writeCandidateAttemptArtifacts({
+            store,
+            attemptDir,
+            worktreePath: envelope.worktree_path,
+            diff,
+            answerText,
+            record: {
+                attempt_id: attemptId,
+                harness_id: adapter.id,
+                label,
+                cost_usd: cost,
+                cost_estimated: costEstimated,
+                errored,
+                errors: errors.slice(0, 5),
+                ...telemetrySummary(telemetry),
+                outcome: telemetry.outcome,
+                gates: gates.map((g) => ({ id: g.id, status: g.status })),
+                branch: envelope.branch_name,
             },
-            branch: envelope.branch_name,
         });
         return {
             attemptId,
@@ -1455,6 +1429,7 @@ export class Orchestrator {
             answerText,
             reviewCwd: envelope.worktree_path,
             baseSha: envelope.base_sha ?? undefined,
+            producedFiles,
             gates,
             cost,
             errored,
@@ -1463,51 +1438,6 @@ export class Orchestrator {
             telemetry,
         };
     }
-    toEvidence(run, contract, findings, finalReviewClean, reviewVerified = false) {
-        const passed = gatesPassed(run.gates) && !run.errored;
-        // Honest acceptance evidence: 0/0 when the contract has no success criteria
-        // (no spec). The old code fabricated a 1/1 ("AC-implicit") cover, which made
-        // arbitration report a vacuous "acceptance=100%" that just restated gates.
-        const acTotal = contract.success_criteria.length;
-        const acCovered = passed && contract.success_criteria.length > 0
-            ? contract.success_criteria.map((c) => c.id)
-            : [];
-        // Treat a harness error as a failed required gate so it cannot win arbitration.
-        const gates = run.errored
-            ? [
-                ...run.gates,
-                {
-                    id: "harness",
-                    command: "harness",
-                    exit_code: 1,
-                    status: "failed",
-                    duration_ms: 0,
-                    required: true,
-                    stdout_tail: null,
-                    stderr_tail: null,
-                    output_truncated: false,
-                },
-            ]
-            : run.gates;
-        return {
-            attemptId: run.attemptId,
-            label: run.label,
-            gates,
-            acceptanceCovered: acCovered,
-            acceptanceTotal: acTotal,
-            findings,
-            // Counted from the EVIDENCE gates (including the injected harness-failure
-            // gate), so an errored candidate scores 0/1 — never a vacuous 0/0.
-            testsPassed: gates.filter((g) => g.status === "passed").length,
-            testsTotal: gates.length,
-            finalReviewClean,
-            reviewVerified,
-            toolWarningsCount: run.telemetry.outcome?.toolWarningsCount ?? toolWarnings(run.telemetry).length,
-            diffSize: run.diff.split("\n").length,
-            diffBytes: Buffer.byteLength(run.diff, "utf8"),
-            costUsd: run.cost,
-        };
-    }
     interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, 
     // REQUIRED (no default): every call site must state the routed manifest's
     // `interactive` capability, or a future site would silently bypass the gate.
@@ -1789,7 +1719,7 @@ export class Orchestrator {
                     budgetStopped = true;
                     return true;
                 }, input, requestedSingleCandidate);
-                ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
+                ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: slot.attemptId,
@@ -2030,9 +1960,11 @@ export class Orchestrator {
                 let envelope;
                 try {
                     const plan = buildSynthesisPlan(evidences);
-                    const sourceDiffs = workingRuns
-                        .map((r) => `### ${r.label} (${r.attemptId})\n${r.diff}`)
-                        .join("\n\n");
+                    const synthesisInput = buildFileBackedSynthesisInput({
+                        instructions: plan.instructions,
+                        findings: plan.fixFindings,
+                        candidates: workingRuns,
+                    });
                     const synthAdapter = synthRouted.adapter;
                     // Disclose against the PER-ROUTE policy (per-harness web defaults
                     // included), exactly like the candidate slots do.
@@ -2045,13 +1977,12 @@ export class Orchestrator {
                         dirtyPolicy: "snapshot",
                         accessProfile: candidateAccess,
                     });
-                    const synthPrompt = `${plan.instructions}\n\nFindings to fix:\n${plan.fixFindings.map((f) => `- ${f}`).join("\n") || "(none)"}\n\nCandidate diffs:\n${sourceDiffs}`;
-                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthPrompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
+                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                         const safeEv = redactHarnessEvent(ev);
                         safeInvoke(input.onHarnessEvent, safeEv);
                         log.emit("harness.event", harnessEventPayload(synthAdapter.id, "synth", safeEv));
-                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
+                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content);
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
                     try {
@@ -2154,6 +2085,13 @@ export class Orchestrator {
         store.writeYaml(join(paths.arbitrationDir, "pairwise.yaml"), result.pairwise);
         const decisionPath = join(paths.arbitrationDir, "decision.yaml");
         if (winnerRun) {
+            for (const path of materializeWinnerOutputs({
+                attemptDir: join(paths.attemptsDir, winnerRun.attemptId),
+                runRoot: paths.root,
+                paths: winnerRun.producedFiles ?? [],
+            })) {
+                log.emit("output.ready", { kind: "artifact", path });
+            }
             assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
             const patchSha256 = sha256(winnerRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), winnerRun.diff);
@@ -2290,7 +2228,7 @@ export class Orchestrator {
             log.emit("output.ready", {
                 kind: "summary",
                 path: "final/summary.md",
-                ...(status === "success" ? {} : { state: "diagnostic" }),
+                state: status === "success" || winnerAnswer.length > 0 ? "ready" : "diagnostic",
             });
         }
         this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), result.decision.status === "success"
@@ -2477,15 +2415,21 @@ export class Orchestrator {
                         distinctProviders: [],
                         reviewSpendUsd: 0,
                         reviewSpendEstimated: false,
+                        reviewCashUsd: 0,
+                        reviewValuationUsd: 0,
+                        reviewUnknownUsd: 0,
                     };
                 if (reviewLease?.granted) {
-                    ledger?.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(result.reviewSpendUsd, result.reviewSpendEstimated, "review-usage", [`attempt:${run.attemptId}`, "review:panel"]));
+                    ledger?.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(result.reviewCashUsd, result.reviewValuationUsd, result.reviewSpendEstimated, [`attempt:${run.attemptId}`, "review:panel"], result.reviewUnknownUsd));
                     if ((result.reviewSpendUsd ?? 0) > 0) {
                         log.emit("budget.observation", {
                             harness_id: "review-panel",
                             attempt_id: run.attemptId,
                             kind: "spend",
                             usd: result.reviewSpendUsd,
+                            cash_usd: result.reviewCashUsd,
+                            valuation_usd: result.reviewValuationUsd,
+                            unknown_usd: result.reviewUnknownUsd,
                             estimated: result.reviewSpendEstimated === true,
                         });
                     }
@@ -2517,6 +2461,7 @@ export class Orchestrator {
                 store.writeYaml(join(paths.reviewsDir, `${run.attemptId}.yaml`), {
                     attempt_id: run.attemptId,
                     review_verified: candidateReviewVerified,
+                    final_review_clean: reviewClean,
                     cross_family_healthy: result.crossFamilyHealthy,
                     cross_family_verified: result.crossFamilyVerified,
                     healthy_providers: result.healthyProviders,
@@ -2532,7 +2477,7 @@ export class Orchestrator {
                         severity: f.severity,
                         status: f.status,
                     });
-                evidences.push(this.toEvidence(run, contract, allFindings, reviewClean, candidateReviewVerified));
+                evidences.push(toCandidateEvidence(run, contract, allFindings, reviewClean, candidateReviewVerified));
             }
             finally {
                 this.recordReviewEvidenceCleanup(store, join(paths.reviewsDir, `${run.attemptId}-evidence-cleanup.yaml`), run.attemptId, candidateEvidenceDir, candidateCwd);
@@ -2818,7 +2763,7 @@ export class Orchestrator {
                         ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
                         return ledger.tier() === "hard";
                     }, input, true);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -2906,15 +2851,21 @@ export class Orchestrator {
                                     distinctProviders: [],
                                     reviewSpendUsd: 0,
                                     reviewSpendEstimated: false,
+                                    reviewCashUsd: 0,
+                                    reviewValuationUsd: 0,
+                                    reviewUnknownUsd: 0,
                                 };
                             if (reviewLease?.granted) {
-                                ledger.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(reviewResult.reviewSpendUsd, reviewResult.reviewSpendEstimated, "review-usage", [`attempt:${attemptId}`, "review:panel"]));
+                                ledger.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(reviewResult.reviewCashUsd, reviewResult.reviewValuationUsd, reviewResult.reviewSpendEstimated, [`attempt:${attemptId}`, "review:panel"], reviewResult.reviewUnknownUsd));
                                 if ((reviewResult.reviewSpendUsd ?? 0) > 0) {
                                     log.emit("budget.observation", {
                                         harness_id: "review-panel",
                                         attempt_id: attemptId,
                                         kind: "spend",
                                         usd: reviewResult.reviewSpendUsd,
+                                        cash_usd: reviewResult.reviewCashUsd,
+                                        valuation_usd: reviewResult.reviewValuationUsd,
+                                        unknown_usd: reviewResult.reviewUnknownUsd,
                                         estimated: reviewResult.reviewSpendEstimated === true,
                                     });
                                     if (reviewResult.reviewSpendEstimated === true)
@@ -2941,9 +2892,15 @@ export class Orchestrator {
                             const policy = policyFindings(run, actualReviewVerified, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.constraints.deny_paths);
                             const allFindings = [...policy.findings, ...revalidated];
                             lastFindings = allFindings;
+                            const inconclusive = allFindings.some((f) => f.severity === "INSUFFICIENT_EVIDENCE" || f.status === "insufficient_evidence");
+                            const finalReviewClean = reviewResult.crossFamilyHealthy &&
+                                reviewResult.crossFamilyVerified &&
+                                !inconclusive &&
+                                !allFindings.some((f) => isBlocking(f));
                             store.writeYaml(join(paths.reviewsDir, `${attemptId}.yaml`), {
                                 attempt_id: attemptId,
                                 review_verified: actualReviewVerified,
+                                final_review_clean: finalReviewClean,
                                 cross_family_healthy: reviewResult.crossFamilyHealthy,
                                 cross_family_verified: reviewResult.crossFamilyVerified,
                                 healthy_providers: reviewResult.healthyProviders,
@@ -2953,11 +2910,6 @@ export class Orchestrator {
                                 findings: allFindings,
                                 route_proofs: reviewResult.routeProofs,
                             });
-                            const inconclusive = allFindings.some((f) => f.severity === "INSUFFICIENT_EVIDENCE" || f.status === "insufficient_evidence");
-                            const finalReviewClean = reviewResult.crossFamilyHealthy &&
-                                reviewResult.crossFamilyVerified &&
-                                !inconclusive &&
-                                !allFindings.some((f) => isBlocking(f));
                             lastFinalReviewClean = finalReviewClean;
                             // Measure diff stability instead of asserting it: the tree must not have
                             // changed between the candidate diff capture and the end of review.
@@ -3081,7 +3033,7 @@ export class Orchestrator {
         let decision = null;
         if (lastRun) {
             const arb = arbitrate([
-                this.toEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
+                toCandidateEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
             ], {
                 spendUsd: ledger.spend(),
                 estimatedSpend: lastRun.costEstimated || reviewSpendEstimated,
@@ -3519,7 +3471,7 @@ export class Orchestrator {
                 }
                 finally {
                     input.signal?.removeEventListener("abort", onAbort);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode));
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
                 }
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
                 const unrecovered = unrecoveredToolErrors(telemetry);
@@ -3643,6 +3595,7 @@ export class Orchestrator {
             if (lease.granted) {
                 const res = await this.reviewScoped({
                     candidateLabel: "Plan",
+                    reviewSubject: "plan",
                     diff: planReviewDiff,
                     evidenceDir: reviewDir,
                     artifactsDir: join(paths.reviewsDir, "plan-reviewers"),
@@ -3662,15 +3615,15 @@ export class Orchestrator {
                     route_proofs: res.routeProofs,
                     reviewer_requests: res.reviewerRequests,
                 });
-                ledger.settle(lease.lease?.lease_id ?? "", usageCostSettlement(res.reviewSpendUsd, res.reviewSpendEstimated, "review-usage", [
-                    "attempt:plan-review",
-                    "review:panel",
-                ]));
+                ledger.settle(lease.lease?.lease_id ?? "", reviewUsageCostSettlement(res.reviewCashUsd, res.reviewValuationUsd, res.reviewSpendEstimated, ["attempt:plan-review", "review:panel"], res.reviewUnknownUsd));
                 if ((res.reviewSpendUsd ?? 0) > 0) {
                     log.emit("budget.observation", {
                         harness_id: "review-panel",
                         kind: "spend",
                         usd: res.reviewSpendUsd,
+                        cash_usd: res.reviewCashUsd,
+                        valuation_usd: res.reviewValuationUsd,
+                        unknown_usd: res.reviewUnknownUsd,
                         estimated: res.reviewSpendEstimated,
                     });
                 }
@@ -4226,7 +4179,7 @@ export class Orchestrator {
             }
             finally {
                 input.signal?.removeEventListener("abort", onAbort);
-                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode));
+                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
             }
             if (harnessError && telemetry.transientFailures.length > 0) {
                 log.emit("route.transient.exhausted", {
@@ -4827,9 +4780,7 @@ export class Orchestrator {
                     ledger.settle(reviewLease.lease?.lease_id ?? "", unknownCostSettlement("review-error"));
                     throw error;
                 });
-                ledger.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(result.reviewSpendUsd, result.reviewSpendEstimated, "review-usage", [
-                    `orchestrate:review:${call.run_id}`,
-                ]));
+                ledger.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(result.reviewCashUsd, result.reviewValuationUsd, result.reviewSpendEstimated, [`orchestrate:review:${call.run_id}`], result.reviewUnknownUsd));
                 const revalidated = await revalidateFindings(result.findings, {
                     candidateRoot: input.repoRoot,
                     evidenceDir,
@@ -4851,7 +4802,7 @@ export class Orchestrator {
                     detail: `reviewed ${call.run_id}: ${result.distinctProviders.length} family(ies), ${revalidated.length} finding(s), ${blockers} blocker(s)`,
                     // Reviewer panels can spend real money on API-keyed routes; the
                     // aggregate cap must charge it like any other step.
-                    spendUsd: result.reviewSpendUsd ?? null,
+                    spendUsd: result.reviewCashUsd,
                 };
             }
             case "answer_question": {