@claudexor/orchestrator 3.6.0 → 3.8.1

package/dist/orchestrator.js

@@ -5,7 +5,7 @@ import { accountPoolRows } from "./account-pool.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
-import { appliedAttemptFacts, assertDelegatedEvidence, confinementNotice, externallyConfinedLane, scopedHarnessHome, } from "./delegatedHome.js";
+import { appliedAttemptFacts, assertDelegatedEvidence, isMutatingAccess, outerBoundaryNotice, scopedHarnessHome, } from "./delegatedHome.js";
 import * as AC from "./attemptUsageCost.js";
 import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, unanimousDeclaredFailure, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
@@ -13,10 +13,10 @@ import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
 import { finalizePlanRun, runCouncilPlan, writePlanHarnessFailure, } from "./planRun.js";
 import { runPlannerAttempt as executePlannerAttempt, } from "./plannerAttempt.js";
-import { HarnessRunSpec, ModeKind as ModeKindSchema, QuotaSnapshot as QuotaSnapshotSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
+import { HarnessRunSpec, ModeKind as ModeKindSchema, QuotaSnapshot as QuotaSnapshotSchema, isBlocking, makeOutcomeFacts, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
 import { globalConfigDir, loadConfig } from "@claudexor/config";
-import { acceptedTryOutput, AnswerAssembly, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
-import { assertRouteModelsAllowed } from "./modelGovernance.js";
+import { acceptedTryOutput, AccessProfileIncompatibleError, AnswerAssembly, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
+import { assertRouteModelsAllowed, runModelGovernedRoute } from "./modelGovernance.js";
 import { authModeForCredentialRoute, authModeForPreference } from "./auth-route-classification.js";
 import { governRouteEffort } from "./effortGovernance.js";
 import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
@@ -32,7 +32,8 @@ import { arbitrationBudgetOptions, decisionBudgetSummary } from "./decisionBudge
 import { buildRevisePrompt } from "./revisePrompt.js";
 import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
-import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
+import { finalizeStructuredOutput } from "./structuredOutput.js";
+import { admitRun } from "./runAdmission.js";
 import { dropDeltaPastBudget, emitPlanProgress, emitTransientExhausted, emitTransientRetryPlan, observeReadonlySpend, } from "./laneStreamEvents.js";
 import { promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
@@ -53,7 +54,7 @@ import { interactionChannelFor } from "./interaction.js";
 import { gateSpecsFromContract, renderTestsEvidence } from "./contract-gates.js";
 import { buildTaskContract } from "./task-contract-builder.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
-import { assertMandatoryContext, buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
+import { buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
 import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureClaudeBridge, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
 import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
@@ -62,7 +63,6 @@ import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
 import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
 import { readTextSafe, appendLine, assertNoInlineSecretValues, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
-import { assertWriteIsolation } from "./write-isolation.js";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 /** Concurrency cap for parallel candidates/explorers (locked decision: min(n, 4)). */
@@ -134,42 +134,11 @@ export class Orchestrator {
                 delegationParentRunId: runId,
             };
         }
-        const projectProtectedPaths = mode === "agent" ? this.projectConfig(resolved.repoRoot).constraints.protected_paths : [];
-        assertWriteIsolation({
-            mode,
-            protectedPaths: projectProtectedPaths,
-            denyPaths: resolved.denyPaths,
-            inPlace: resolved.inPlace,
-            repoRoot: resolved.repoRoot,
-            executionRoot: this.execRootOf(resolved),
+        resolved.outputSchema = admitRun(resolved, mode, {
+            accessDefault: this.config(resolved.repoRoot).trust.access_default,
+            projectProtectedPaths: () => this.projectConfig(resolved.repoRoot).constraints.protected_paths,
+            mandatoryFiles: () => this.projectConfig(resolved.repoRoot).context.mandatory_files,
         });
-        // outputSchema constrains the run's final ANSWER. It is honored exactly
-        // where a final answer is delivered (agent race incl. synthesis, and ask);
-        // every other strategy refuses loudly rather than carrying a contract the
-        // engine would not validate (INV-023). The schema itself is normalized for
-        // the native structured-output routes here at the boundary — unsupported
-        // shapes (external/cyclic $ref, non-object root) are a typed refusal, not a mid-run 400.
-        if (resolved.outputSchema !== undefined && resolved.outputSchema !== null) {
-            if (mode !== "agent" && mode !== "ask") {
-                throw new Error(`outputSchema constrains the final answer and applies to agent/ask runs (got mode=${mode}); drop the schema or switch modes`);
-            }
-            if (resolved.untilClean || (resolved.attempts !== undefined && resolved.attempts !== null)) {
-                throw new Error("outputSchema is not supported with convergence flags (--until-clean/--attempts): convergence delivers a gated patch, not a structured answer; drop the schema or the convergence flags");
-            }
-            // Shape-refuse unsupported schemas, then PROVE it compiles under the same
-            // ajv the engine validator uses — a malformed schema is a preflight
-            // refusal here (before any run dir), never a mid-run validator crash. The
-            // contract keeps the ORIGINAL (conformance authority); local-ref inlining
-            // and strictification are transport-only transforms in harnessSpecKnobs.
-            resolved.outputSchema = normalizeUserOutputSchema(resolved.outputSchema);
-            assertOutputSchemaCompiles(resolved.outputSchema);
-        }
-        // P1: a versioned `mandatory_files` contract is enforced UNIFORMLY here, for
-        // every mode, so the same repo state can't pass `run`/`ask` while failing
-        // `audit`. No-op when the list is empty (the default) or for no-project runs.
-        if (resolved.repoRoot !== NO_PROJECT_ROOT) {
-            assertMandatoryContext(resolved.repoRoot, this.projectConfig(resolved.repoRoot).context.mandatory_files);
-        }
         // Reviewer panels are validated only inside Agent strategies that actually
         // review (race/convergence; Plan Council is the plan critique path) — AFTER run-dir
         // creation, so a doomed explicit panel yields typed failure ARTIFACTS
@@ -491,8 +460,7 @@ export class Orchestrator {
         const policy = input.web ?? input.externalContextPolicy ?? "auto";
         const pool = [];
         const dropped = [];
-        // Structured requested-vs-effective route receipt (QA-043): every auto-pool
-        // drop is recorded with its typed STAGE so the disclosure preserves the
+        // Every auto-pool drop is recorded with its typed STAGE so the disclosure preserves the
         // real cause instead of collapsing to one reason.
         const droppedLanes = [];
         // The ONE explicit-lane admission gate shared by every drop site (QA-043 /
@@ -501,14 +469,18 @@ export class Orchestrator {
         // substitution or self-race duplication; an AUTO lane is dropped with a
         // typed omission recorded for the degradation receipt.
         const dropLane = (harnessId, stage, detail) => {
-            if (explicitPool)
+            if (explicitPool) {
+                if (stage === "access")
+                    throw new AccessProfileIncompatibleError(detail);
                 throw new HarnessUnavailableError(detail);
+            }
             dropped.push(detail);
             droppedLanes.push({ harnessId, stage, detail });
         };
         // One observation set for the whole admission pass, so two lanes cannot be
         // judged against different vendor epochs.
         const vendorQuota = this.credentials.vendorQuotaObservations();
+        const liveUnusable = this.deps.credentialUnusable?.() ?? [];
         for (const id of ids) {
             const adapter = this.deps.registry.get(id);
             if (!adapter) {
@@ -577,14 +549,8 @@ export class Orchestrator {
             const profileAdapter = this.deps.registry.get(id);
             const profileProbe = profileAdapter?.probeCredentialProfile?.bind(profileAdapter);
             const explicitPin = this.credentials.effectiveProfileId(input, id);
-            // The account candidates whose readiness may overlay the default-store
-            // verdict: the explicit pin when set; otherwise — row-aware UNPINNED
-            // admission — the thread-bound row followed by the harness's enabled
-            // pool rows, consulted only when the default doctor did not already
-            // admit the lane. A signed-in registry row is invisible to the default
-            // doctor (cursor after the host-Keychain retirement, or a named-rows-
-            // only claude/codex install), so an unpinned run must be admitted on
-            // row readiness exactly the way explicit pins already are.
+            const model = input.models?.[id] ?? cfgEntry?.default_model ?? null;
+            // Pins and bound/pool rows are checked against their own readiness.
             const rowCandidateIds = [];
             if (explicitPin) {
                 rowCandidateIds.push(explicitPin);
@@ -603,9 +569,12 @@ export class Orchestrator {
                     probe: profileProbe,
                     // `verification: passed` from the local store only means a login file
                     // is present. The poller's authenticated vendor call is the only
-                    // liveness evidence we have, and admission is the surface that must
-                    // act on it — otherwise the run dispatches into a revoked token.
+                    // liveness evidence; admission must act on it or dispatch may use a revoked token.
                     quota: vendorQuota,
+                    unusable: liveUnusable,
+                    model,
+                    // Only an explicit/bound route may consume bounded stale LKG evidence.
+                    allowStale: explicitPin !== null || input.threadAccountBindings?.[id] === candidateId,
                 });
                 if (verdict === "available") {
                     profileAdmitted = true;
@@ -645,7 +614,7 @@ export class Orchestrator {
             const readOnlyIntent = intent === "plan" || intent === "spec" || intent === "explain" || intent === "audit";
             const requiredAccess = this.requestRequirements.adapterAccess(intent, manifest.capabilities.implementation_transport, readOnlyIntent
                 ? "readonly"
-                : (input.access ?? this.config(input.repoRoot).trust.access_default), externallyConfinedLane(input.delegated === true));
+                : (input.access ?? this.config(input.repoRoot).trust.access_default));
             const accessSupported = !requiredAccess || manifest.access_profiles_supported.includes(requiredAccess);
             const webSupport = manifest.capabilities.web_policy;
             // Match routeSpecKnobs: a per-harness web default upgrades run-level auto,
@@ -679,6 +648,7 @@ export class Orchestrator {
                         harnessId: id,
                         requested: input.browser === true,
                         manifestCapable: manifest.capabilities.browser_tool,
+                        requiresFullAccess: manifest.capability_profile.mcp_injection_requires_full_access,
                         webPolicy: routePolicy,
                         access: requiredAccess,
                     }),
@@ -730,6 +700,9 @@ export class Orchestrator {
             }
         }
         if (pool.length === 0) {
+            if (droppedLanes.length > 0 && droppedLanes.every((lane) => lane.stage === "access")) {
+                throw new AccessProfileIncompatibleError(`no harness can enforce the requested access profile (${droppedLanes.map((lane) => lane.detail).join(", ")})`);
+            }
             throw new HarnessUnavailableError(`no harness can perform '${intent}' for this mode${dropped.length ? ` (skipped: ${dropped.join(", ")})` : ""}`);
         }
         // Quota admission must use the account that will actually spawn. In
@@ -850,7 +823,7 @@ export class Orchestrator {
             }
         }
         // Strict pre-run model gate (INV-104) — see modelGovernance.ts.
-        await assertRouteModelsAllowed(out, input.models, this.execRootOf(input));
+        await assertRouteModelsAllowed(out, input.models, this.execRootOf(input), (id) => routeContext ? (routeContext.envForHarness?.(id) ?? routeContext.env) : undefined);
         return out;
     }
     /**
@@ -1382,8 +1355,8 @@ export class Orchestrator {
     /** Decided by `harnessHomeFor` in the CALLER, so the per-attempt applied
      * facts exist in the caller's catch too: an attempt that ran and then threw
      * must record what it ran under, not just why it stopped. REQUIRED (no
-     * default): a silent fallback here would spawn a delegated child on the
-     * operator's real home while the record still claimed confinement. */
+     * default): a silent fallback here would spawn a delegated attempt on the
+     * operator's real home while the record still claimed scoped state. */
     harnessHome) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
@@ -1412,8 +1385,8 @@ export class Orchestrator {
             // Engine-derived read-only prompt constraints: protected/auto-protected
             // paths PLUS the exact typed gate argv the run will execute (QA-022 FIX B).
             prompt: promptWithEngineConstraints(
-            // A child running without an OS boundary is TOLD so (disclosure 2 of 3).
-            [prompt, confinementNotice(harnessHome), laneContinuity?.pointerLine, continuationPointer]
+            // The child is told that Claudexor adds no outer OS boundary (disclosure 2 of 3).
+            [prompt, outerBoundaryNotice(harnessHome), laneContinuity?.pointerLine, continuationPointer]
                 .filter((s) => typeof s === "string" && s.length > 0)
                 .join("\n\n"), contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.tests.commands),
             attachments: runInput?.attachments ?? [],
@@ -1440,11 +1413,8 @@ export class Orchestrator {
             // Scoped harness home for isolated envelopes AND for every delegated run;
             // an ordinary in-place run keeps the native environment so the resumed
             // vendor session is reachable. See scopedHarnessHome for the cost a
-            // delegated in-place attempt pays for that confinement.
+            // delegated in-place attempt pays for that scoped state.
             ...(harnessHome.env ? { env: harnessHome.env } : {}),
-            // The OS boundary itself. The shared CLI run loop wraps the argv with it;
-            // no adapter opts in, so no adapter can forget.
-            confinement: harnessHome.confinement,
             raw_context_packet: rawContextPacket,
             stream_deltas: streamDeltas,
         });
@@ -1523,7 +1493,7 @@ export class Orchestrator {
                 const rateLimitStart = telemetry.rateLimits.length;
                 let rawPatch = null;
                 try {
-                    const watched = withInactivityWatchdog(adapter.run(runSpec), {
+                    const watched = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec), {
                         timeoutMs: inactivityMs,
                         countsAsProgress: countsAsAgentProgress,
                         onTimeout: () => {
@@ -1791,7 +1761,7 @@ export class Orchestrator {
             worktreePath: envelope.worktree_path,
             artifactRelativeDir,
             diff,
-            persistPatch: secretDiffRefusal === undefined,
+            persistPatch: secretDiffRefusal === undefined && isMutatingAccess(access),
             persistProducedMedia: secretDiffRefusal === undefined,
             answerText,
             record: {
@@ -1807,8 +1777,8 @@ export class Orchestrator {
                 ...(secretDiffRefusal ? { secret_diff_refusal: secretDiffRefusal } : {}),
                 gates: gates.map((g) => ({ id: g.id, status: g.status })),
                 branch: envelope.branch_name,
-                // Applied facts, not promises: the caller of a delegated run
-                // verifies the confinement it asked for instead of trusting it.
+                // Applied facts, not promises: historical proofs stay readable and
+                // current delegated runs state deliberate outer-boundary absence.
                 // Built by the SAME shape the failure path writes.
                 ...applied,
             },
@@ -1888,6 +1858,7 @@ export class Orchestrator {
         // announced: a refused run must fail the request loudly, not 200 a runId
         // and leave an orphaned run dir without a terminal event.
         const contract = this.buildContract(input, taskId, mode);
+        const mutatingRun = isMutatingAccess(contract.access.effective_profile);
         const planBrief = verifiedPlanBrief(input);
         const quotaSnapshots = this.quotaSnapshotPreflight();
         const { store, paths, log, ledger } = beginAnnouncedRun({
@@ -1918,28 +1889,32 @@ export class Orchestrator {
         // directory, a filesystem root, or one that cannot be classified), which
         // gets a typed refusal BEFORE any mutation (INV-075). For an isolated
         // thread the execution root is already a git worktree: a no-op there.
-        const gitPreconditionError = await ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
-        if (gitPreconditionError) {
-            return {
-                runId,
-                taskId,
-                mode,
-                lifecycle: "failed",
-                facts: makeOutcomeFacts("failed", { reason: gitPreconditionError.reason }),
-                winner: null,
-                runDir: paths.root,
-                summary: gitPreconditionError.message,
-                candidates: [],
-            };
+        if (mutatingRun) {
+            const gitPreconditionError = await ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
+            if (gitPreconditionError) {
+                return {
+                    runId,
+                    taskId,
+                    mode,
+                    lifecycle: "failed",
+                    facts: makeOutcomeFacts("failed", { reason: gitPreconditionError.reason }),
+                    winner: null,
+                    runDir: paths.root,
+                    summary: gitPreconditionError.message,
+                    candidates: [],
+                };
+            }
         }
         // Same run-prep stage as the git boundary: if the PROJECT root uses AGENTS.md
         // with no CLAUDE.md, bridge it so a Claude Code candidate reads it (INV-113).
-        this.ensureClaudeBridgeForRun(input.repoRoot, input.inPlace === true, log);
+        if (mutatingRun) {
+            this.ensureClaudeBridgeForRun(input.repoRoot, input.inPlace === true, log);
+        }
         // Pre-turn snapshot of the live tree for in-place runs: the revert restore
         // target (server-owned revertInPlace). A snapshot failure must never fail the
         // run — revert is simply unavailable then.
         let preTurnSha = null;
-        if (input.inPlace === true) {
+        if (mutatingRun && input.inPlace === true) {
             try {
                 preTurnSha = await snapshotTree(execRoot);
             }
@@ -2109,9 +2084,10 @@ export class Orchestrator {
                     accessProfile: candidateAccess,
                     // Direct-workspace singletons run in place. Races and patch-envelope
                     // transports stay isolated and adopt through the delivery service.
-                    inPlace: input.inPlace === true &&
-                        requestedSingleCandidate &&
-                        slot.routed.implementationTransport !== "git_patch_envelope",
+                    inPlace: !mutatingRun ||
+                        (input.inPlace === true &&
+                            requestedSingleCandidate &&
+                            slot.routed.implementationTransport !== "git_patch_envelope"),
                 });
                 harnessHome = this.harnessHomeFor(wsm, envelope, slot.routed, input);
                 const run = await this.runCandidateInEnvelope(slot.routed, envelope, slot.attemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
@@ -2287,8 +2263,8 @@ export class Orchestrator {
         };
         await runBounded(slots, Math.min(slots.length, MAX_PARALLEL_CANDIDATES), runSlot);
         const runs = runsBySlot.filter((r) => r !== undefined);
-        // Fail-closed terminal: a delegated mutating run whose attempts cannot state
-        // their applied confinement refuses instead of passing.
+        // Fail-closed terminal: a delegated mutating run whose attempts state
+        // neither historical proof nor deliberate absence refuses instead of passing.
         assertDelegatedEvidence(input.delegated === true, candidateAccess, runs);
         const cancelledCandidates = () => runs.map((r) => ({
             attemptId: r.attemptId,
@@ -2306,7 +2282,10 @@ export class Orchestrator {
         // arbitration (as the race-adoption path does) would fold those user edits
         // into the revert target and let a later revert clobber them.
         let earlyPostTurnSha = null;
-        if (input.inPlace && requestedSingleCandidate && runs.every((run) => !run.secretDiffRefusal)) {
+        if (mutatingRun &&
+            input.inPlace &&
+            requestedSingleCandidate &&
+            runs.every((run) => !run.secretDiffRefusal)) {
             try {
                 earlyPostTurnSha = await snapshotTree(execRoot);
             }
@@ -2322,13 +2301,15 @@ export class Orchestrator {
         if (failedDelegation) {
             const failure = delegateFailure.candidateFailureTerminal(failedDelegation, "race");
             await disposeReviewEnvelopes();
-            await delegateFailure.persistFailedInPlaceWorkProduct({
-                ...{ store, log, paths, execRoot, preTurnSha, taskId, mode },
-                live: input.inPlace === true && failedDelegation.reviewCwd === execRoot,
-                run: failedDelegation,
-                postTurnSha: earlyPostTurnSha,
-                kind: input.create === true ? "new_repo" : "patch",
-            });
+            if (mutatingRun) {
+                await delegateFailure.persistFailedInPlaceWorkProduct({
+                    ...{ store, log, paths, execRoot, preTurnSha, taskId, mode },
+                    live: input.inPlace === true && failedDelegation.reviewCwd === execRoot,
+                    run: failedDelegation,
+                    postTurnSha: earlyPostTurnSha,
+                    kind: input.create === true ? "new_repo" : "patch",
+                });
+            }
             this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null);
             return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), failure.metadata);
         }
@@ -2510,7 +2491,13 @@ export class Orchestrator {
             return cancelledRaceResult();
         }
         // Synthesis: if worthwhile, run a synthesizer as a NEW, re-checked candidate.
-        const synth = decideSynthesis(evidences, input.synthesis ?? "auto");
+        const synth = mutatingRun
+            ? decideSynthesis(evidences, input.synthesis ?? "auto")
+            : {
+                synthesize: false,
+                reason: "readonly access has no write-backed synthesis lifecycle",
+                sources: evidences.map((evidence) => evidence.attemptId),
+            };
         store.writeYaml(join(paths.arbitrationDir, "synthesis.yaml"), synth);
         log.emit("synthesis.started", { synthesize: synth.synthesize, reason: synth.reason });
         if (synth.synthesize && !budgetStopped) {
@@ -2639,7 +2626,8 @@ export class Orchestrator {
         // instead defers verification until immediately before delivery.
         const inPlaceWinner = winnerRun?.reviewCwd === execRoot;
         const deferredRaceVerify = input.inPlace === true && !inPlaceWinner;
-        if (winnerRun &&
+        if (mutatingRun &&
+            winnerRun &&
             !inPlaceWinner &&
             !deferredRaceVerify &&
             winnerRun.diff.trim().length > 0 &&
@@ -2674,17 +2662,7 @@ export class Orchestrator {
             })) {
                 log.emit("output.ready", { kind: "artifact", path });
             }
-            secretDiff.assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
-            const patchSha256 = sha256(winnerRun.diff);
-            store.writeText(join(paths.finalDir, "patch.diff"), winnerRun.diff);
-            const wstats = diffStats(winnerRun.diff);
-            const hasDiff = winnerRun.diff.trim().length > 0;
-            const blockers = winnerEvidence
-                ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
-                : 0;
-            // Prose from an empty-diff winner is an answer, never a patch.
             const winnerAnswer = winnerRun.answerText ?? "";
-            const resultKind = hasDiff ? "patch" : winnerAnswer.length > 0 ? "answer" : "none";
             // The winner's final MESSAGE is the human-facing answer and materializes
             // for diff-ful runs too: the chat renders final/answer.md (the projection
             // prefers it), never the arbitration summary — "Run … Winner: a01 …" is
@@ -2705,107 +2683,120 @@ export class Orchestrator {
                     answerText: winnerAnswer,
                 });
             }
-            // Only a fully verified, applyable success may auto-adopt; a not-verified
-            // or needs-decision terminal remains an inspectable artifact.
-            const adoptable = facts.lifecycle === "succeeded" && facts.review === "approved" && facts.checks !== "failed";
-            let adopted = null;
-            let applyState = "not_applied";
-            let postTurnSha = null;
-            let revertAnchorId = null;
-            if (input.inPlace === true && hasDiff) {
-                if (inPlaceWinner) {
-                    // Already live: the candidate ran in-place and wrote the tree itself.
-                    adopted = true;
-                    applyState = adoptable ? "applied" : "applied_review_blocked";
-                    // The pre-review fence excludes later user edits from the target.
-                    postTurnSha = earlyPostTurnSha;
-                }
-                else if (adoptable) {
-                    // Protected apply preserves the live tree or reports tree_mutated.
-                    const applied = await verifyAndDeliver(execRoot, winnerRun.diff, { mode: "apply", protectedApply: true }, gateSpecsFromContract(contract), (freshVerify) => {
-                        finalVerify = freshVerify;
-                        return finalVerifyBlocks(freshVerify)
-                            ? (freshVerify.reason ?? "final verify failed before race adoption")
-                            : null;
-                    }, log);
-                    raceDeliveryReceipt = applied;
-                    store.writeYaml(join(paths.finalDir, "delivery_receipt.yaml"), applied);
-                    finalVerify = applied.finalVerify;
-                    if (applied.applied) {
+            if (mutatingRun) {
+                secretDiff.assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
+                const patchSha256 = sha256(winnerRun.diff);
+                store.writeText(join(paths.finalDir, "patch.diff"), winnerRun.diff);
+                const wstats = diffStats(winnerRun.diff);
+                const hasDiff = winnerRun.diff.trim().length > 0;
+                const blockers = winnerEvidence
+                    ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
+                    : 0;
+                const resultKind = hasDiff ? "patch" : winnerAnswer.length > 0 ? "answer" : "none";
+                // Only a fully verified, applyable success may auto-adopt; a not-verified
+                // or needs-decision terminal remains an inspectable artifact.
+                const adoptable = facts.lifecycle === "succeeded" &&
+                    facts.review === "approved" &&
+                    facts.checks !== "failed";
+                let adopted = null;
+                let applyState = "not_applied";
+                let postTurnSha = null;
+                let revertAnchorId = null;
+                if (input.inPlace === true && hasDiff) {
+                    if (inPlaceWinner) {
+                        // Already live: the candidate ran in-place and wrote the tree itself.
                         adopted = true;
-                        applyState = "applied";
-                        log.emit("work_product.adopted", {
-                            applied: true,
-                            patch_sha256: patchSha256,
-                            winner: winnerRun.attemptId,
-                        });
-                        try {
-                            postTurnSha = await snapshotTree(execRoot);
+                        applyState = adoptable ? "applied" : "applied_review_blocked";
+                        // The pre-review fence excludes later user edits from the target.
+                        postTurnSha = earlyPostTurnSha;
+                    }
+                    else if (adoptable) {
+                        // Protected apply preserves the live tree or reports tree_mutated.
+                        const applied = await verifyAndDeliver(execRoot, winnerRun.diff, { mode: "apply", protectedApply: true }, gateSpecsFromContract(contract), (freshVerify) => {
+                            finalVerify = freshVerify;
+                            return finalVerifyBlocks(freshVerify)
+                                ? (freshVerify.reason ?? "final verify failed before race adoption")
+                                : null;
+                        }, log);
+                        raceDeliveryReceipt = applied;
+                        store.writeYaml(join(paths.finalDir, "delivery_receipt.yaml"), applied);
+                        finalVerify = applied.finalVerify;
+                        if (applied.applied) {
+                            adopted = true;
+                            applyState = "applied";
+                            log.emit("work_product.adopted", {
+                                applied: true,
+                                patch_sha256: patchSha256,
+                                winner: winnerRun.attemptId,
+                            });
+                            try {
+                                postTurnSha = await snapshotTree(execRoot);
+                            }
+                            catch {
+                                postTurnSha = null;
+                            }
+                            revertAnchorId = createRevertAnchorFromPatchOrNull(execRoot, winnerRun.diff);
                         }
-                        catch {
-                            postTurnSha = null;
+                        else {
+                            adopted = false;
+                            applyState = "not_applied";
+                            deliveryFailureReason = applied.detail ?? "race adoption delivery was refused";
+                            facts = { ...facts, checks: "failed", reason: "checks_failed" };
+                            if (finalVerifyBlocks(finalVerify))
+                                finalVerifyFailed = true;
+                            log.emit("work_product.adopted", {
+                                applied: false,
+                                patch_sha256: patchSha256,
+                                detail: redactSecrets(applied.detail ?? "apply failed"),
+                                tree_mutated: applied.treeMutated,
+                            });
                         }
-                        revertAnchorId = createRevertAnchorFromPatchOrNull(execRoot, winnerRun.diff);
-                    }
-                    else {
-                        adopted = false;
-                        applyState = "not_applied";
-                        deliveryFailureReason = applied.detail ?? "race adoption delivery was refused";
-                        facts = { ...facts, checks: "failed", reason: "checks_failed" };
-                        if (finalVerifyBlocks(finalVerify))
-                            finalVerifyFailed = true;
-                        log.emit("work_product.adopted", {
-                            applied: false,
-                            patch_sha256: patchSha256,
-                            detail: redactSecrets(applied.detail ?? "apply failed"),
-                            tree_mutated: applied.treeMutated,
-                        });
                     }
                 }
-            }
-            writeRaceDeliveryDecision(store, decisionPath, {
-                decision: result.decision,
-                facts,
-                reviewVerified: actualReviewVerified,
-                finalVerify,
-                deliveryFailureReason,
-                deliveryReceiptPath: raceDeliveryReceipt ? "final/delivery_receipt.yaml" : null,
-            });
-            if (inPlaceWinner && requestedSingleCandidate && adopted === true) {
-                revertAnchorId = await createRevertAnchorOrNull(execRoot, preTurnSha, postTurnSha);
-            }
-            store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
-                id: newId("wp"),
-                kind: input.create === true ? "new_repo" : "patch",
-                source_task_id: taskId,
-                producer_attempt_id: winnerRun.attemptId,
-                ...(raceDeliveryReceipt
-                    ? { files: { delivery_receipt: "final/delivery_receipt.yaml" } }
-                    : {}),
-                meta: {
-                    harness_id: winnerRun.harnessId,
-                    synthesis: synth,
-                    mode,
-                    // Artifact-only apply reads the same terminal axes as the daemon (D8).
-                    lifecycle: facts.lifecycle,
-                    outcome_facts: facts,
-                    review_verified: actualReviewVerified,
-                    budget_stopped: budgetStopped,
-                    patch_sha256: patchSha256,
-                    result_kind: resultKind,
-                    diffstat: {
-                        files: wstats.paths.length,
-                        additions: wstats.additions,
-                        deletions: wstats.deletions,
+                writeRaceDeliveryDecision(store, decisionPath, {
+                    decision: result.decision,
+                    facts,
+                    reviewVerified: actualReviewVerified,
+                    finalVerify,
+                    deliveryFailureReason,
+                    deliveryReceiptPath: raceDeliveryReceipt ? "final/delivery_receipt.yaml" : null,
+                });
+                if (inPlaceWinner && requestedSingleCandidate && adopted === true) {
+                    revertAnchorId = await createRevertAnchorOrNull(execRoot, preTurnSha, postTurnSha);
+                }
+                store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
+                    id: newId("wp"),
+                    kind: input.create === true ? "new_repo" : "patch",
+                    source_task_id: taskId,
+                    producer_attempt_id: winnerRun.attemptId,
+                    ...(raceDeliveryReceipt
+                        ? { files: { delivery_receipt: "final/delivery_receipt.yaml" } }
+                        : {}),
+                    meta: {
+                        harness_id: winnerRun.harnessId,
+                        synthesis: synth,
+                        mode,
+                        // Artifact-only apply reads the same terminal axes as the daemon (D8).
+                        lifecycle: facts.lifecycle,
+                        outcome_facts: facts,
+                        review_verified: actualReviewVerified,
+                        budget_stopped: budgetStopped,
+                        patch_sha256: patchSha256,
+                        result_kind: resultKind,
+                        diffstat: {
+                            files: wstats.paths.length,
+                            additions: wstats.additions,
+                            deletions: wstats.deletions,
+                        },
+                        blockers,
+                        adopted,
+                        apply_state: applyState,
+                        pre_turn_sha: preTurnSha,
+                        post_turn_sha: postTurnSha,
+                        revert_anchor_id: revertAnchorId,
                     },
-                    blockers,
-                    adopted,
-                    apply_state: applyState,
-                    pre_turn_sha: preTurnSha,
-                    post_turn_sha: postTurnSha,
-                    revert_anchor_id: revertAnchorId,
-                },
-            });
+                });
+            }
             store.writeText(join(paths.finalDir, "summary.md"), renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified));
             // summary.md is a DIAGNOSTIC artifact only (V8/PLAN addendum 2): it no
             // longer carries primary-output authority. A clean applyable success or a
@@ -2906,7 +2897,9 @@ export class Orchestrator {
                 });
             }
         }
-        log.emit("work_product.emitted", { winner: result.decision.winner });
+        if (mutatingRun && winnerRun) {
+            log.emit("work_product.emitted", { winner: result.decision.winner });
+        }
         if (!isFailureTerminal) {
             log.emit("run.completed", { lifecycle: facts.lifecycle, facts, reason: facts.reason });
         }
@@ -4032,15 +4025,14 @@ export class Orchestrator {
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // W3.3: ONE resolved read-only context — the routing point-probe and every
-        // planner spawn consume the SAME scoped env (see routeContext.ts). The
-        // probe home stays a disposable throwaway even for a thread lane turn (auth
-        // truth is home-independent); only the planner spawn swaps in the durable
-        // per-lane home below so its recorded native session survives.
-        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
+        // planner spawn consume the SAME scoped env (see routeContext.ts).
         // A thread PLAN turn is a chat turn (INV-034): plan candidates are distinct
-        // harnesses run sequentially, so each records its own lane's native session
-        // and the next lane turn resumes it via `sessionSpecFields.resume_session_id`.
+        // harnesses run sequentially. Doctor, model inventory, and spawn share each
+        // lane's durable HOME; the disposable context remains the non-thread fallback.
         const laneRun = Boolean(input.threadId);
+        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
+            ? (id) => this.laneHomeEnvFor(input, id, input.credentialProfileId ?? null)
+            : undefined);
         let adapters;
         try {
             adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome, runId);
@@ -4401,17 +4393,13 @@ export class Orchestrator {
                 : Math.min(Math.max(input.n ?? 2, 1), 3);
         // W3.3: ONE resolved read-only context — the routing point-probe and every
         // read-only attempt spawn consume the SAME scoped env (see routeContext.ts).
-        // The point-probe home is a disposable throwaway even for a thread lane
-        // turn: readiness auth truth is home-INDEPENDENT (credentials come from the
-        // profile/keychain/default store, never the scoped home), so the probe and
-        // the run share the same auth source; only the ACTUAL spawn swaps in the
-        // durable per-lane home below so the recorded native session survives.
-        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
         // A thread ASK turn is a chat turn: its native session is recorded per lane
-        // and the next lane turn resumes it (INV-034). Deep-scan (multi-scout
-        // research) and orchestrate (tool-belt planner, not the user's chat) are
-        // NOT lane chat turns — they keep the disposable home and record nothing.
+        // and the next lane turn resumes it (INV-034). Its doctor/model/spawn path
+        // shares that lane HOME; deep-scan and one-shot asks keep the disposable one.
         const laneRun = Boolean(input.threadId) && opts.mode === "ask" && !opts.deepScan;
+        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
+            ? (id) => this.laneHomeEnvFor(input, id, input.credentialProfileId ?? null)
+            : undefined);
         let adapters;
         try {
             adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, log, roHome, runId, 
@@ -4707,7 +4695,7 @@ export class Orchestrator {
                         ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
                     });
                     try {
-                        const watchedReport = withInactivityWatchdog(adapter.run(runSpec), {
+                        const watchedReport = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec), {
                             timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
                             countsAsProgress: countsAsAgentProgress,
                             onTimeout: () => {