@cohortapp/agent-sdk 2.4.0 → 2.5.0

package/scripts/daemon/agent-daemon.mjs

@@ -59,6 +59,9 @@ import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock
 import { markDeferred } from "./inbox-deferral.mjs";
 import { parseQueueItems, rankBacklog, resolveBacklogWeights } from "../../lib/backlog.mjs";
 import { readLatestGaps } from "../../lib/goals/gaps.mjs";
+import { RUNGS } from "../../lib/execution/route.mjs";
+/** rung id → the machinery `routeRung` named for it. Built from the one table. */
+const RUNG_MECHANISM = Object.fromEntries(RUNGS.map((r) => [r.id, r.mechanism]));
 // Org shared-memory write-back (central store via memory.author / knowledge.append
 // RPC). After a daemon turn completes cleanly we distil a one-line record of the
 // work and land it in the org's shared, ACL'd store so the fleet's memory
@@ -79,6 +82,20 @@ import { mintTraceId, withTrace } from "../../lib/diagnostics/trace.mjs";
 import { emitEvent, EVENT_TYPES } from "../../lib/diagnostics/events.mjs";
 import * as counters from "../../lib/diagnostics/counters.mjs";
 import { getHookBus } from "../../lib/hooks/bus.mjs";
+// EXECUTION LADDER (lib/execution/**). The reactive front of the chain:
+// intake (what surface is this, and is it mine) → match (which compiled
+// obligation covers it) → route (which rung: protocol call, skill, plugin,
+// Claude session, workflow, sub-agent team) → drive (run the effect) → journal
+// (why, on disk, before the effect runs). Until now nothing in the daemon
+// entered it; processItem went straight from item_received to the Haiku
+// classifier, so every event was implicitly "react now, rung 3" regardless of
+// surface, obligation or budget. It is now the FRONT of processItem: the
+// classifier path below is the mechanism the ladder's `react` effect drives,
+// not a parallel universe.
+import { processOne } from "../../lib/execution/pipeline.mjs";
+import { defaultEffects, scheduleToQueue } from "../../lib/execution/effects.mjs";
+import { loadReactObligations } from "../../lib/execution/match.mjs";
+import { policyFor } from "../../lib/execution/surface-policy.mjs";
 
 // ---------------------------------------------------------------------------
 // Configuration
@@ -250,6 +267,70 @@ export async function processItem(item, service, deps = {}) {
 }
 
 async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
+  emitEvent({
+    type: EVENT_TYPES.ITEM_RECEIVED,
+    trace_id,
+    attrs: { item_id: itemId, service, sender: item.sender || null, kind: item.kind || "message" },
+  });
+
+  // Enrich item with channel-type metadata for directed-message detection.
+  // HOISTED above the execution ladder: `intake` reads `is_dm` to tell a private
+  // room from a space, and a DM that arrived here without it would be classified
+  // as an ambient space message and parked. This is the single most
+  // regression-prone line in the file.
+  enrichItem(item, service);
+
+  // ── THE EXECUTION LADDER, at the front of the chain ──────────────────────
+  // Returns `{ handled }`. `handled:true` means the ladder took responsibility
+  // for this item — it ignored it (journalled), queued it, delegated it,
+  // escalated it, or drove the classifier path below through its `react` effect.
+  // `handled:false` means the ladder could not establish ownership and the
+  // legacy classifier path runs exactly as it did before. Never throws.
+  const gate = await runExecutionLadder(item, service, itemId, trace_id, deps);
+  if (gate.handled) return;
+
+  return answerItem(item, service, itemId, trace_id, deps, gate.decision);
+}
+
+/**
+ * Attach the channel-type metadata every downstream directedness check reads.
+ * Extracted so the execution ladder and the classifier path cannot disagree
+ * about what `is_dm` means for the same item.
+ *
+ * @param {object} item
+ * @param {string} service
+ * @returns {object} the same item, mutated
+ */
+export function enrichItem(item, service) {
+  const channelStr = (item.channel || "").toLowerCase();
+  const channelId = item.channel_id || "";
+  const isDm = channelStr.startsWith("dm/") || channelId.startsWith("D");
+  const myFirstName = loadAgent().firstName || "Agent";
+  const agentThreadRegex = new RegExp(`^${myFirstName}:`, "m");
+  const agentInThread = !!(item.thread_context && agentThreadRegex.test(item.thread_context));
+  item.is_dm = isDm;
+  item.agent_in_thread = agentInThread;
+  if (!item.service) item.service = service;
+  return item;
+}
+
+/**
+ * The classifier → quick-reply-or-session path. This is UNCHANGED behaviour:
+ * it is the body `processItem` used to run inline. It is now a named mechanism
+ * so the execution ladder's `react_now` disposition can drive it as an effect,
+ * and so an item the ladder cannot place still gets exactly today's handling.
+ *
+ * @param {object} item
+ * @param {string} service
+ * @param {string} itemId
+ * @param {string} trace_id
+ * @param {object} deps
+ * @param {object|null} [routed] the ladder's decision, when there was one. Its
+ *   `rung` is honoured: rung 0/1 (protocol call / bounded skill) may answer via
+ *   the in-process quick-reply responder; rung ≥2 requires a spawned session.
+ * @returns {Promise<{ok:boolean, path:string, reason?:string}>}
+ */
+export async function answerItem(item, service, itemId, trace_id, deps = {}, routed = null) {
   // Resolve collaborators: real imports by default (production), injected fakes
   // only when a test supplies them. Names match the imported symbols 1:1.
   const _classify = deps.classify || classifyItem;
@@ -258,22 +339,13 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
   const _sendHoldingMessage = deps.sendHoldingMessage || sendHoldingMessage;
   const _isQuickReply = deps.isQuickReply || isQuickReply;
 
-  emitEvent({
-    type: EVENT_TYPES.ITEM_RECEIVED,
-    trace_id,
-    attrs: { item_id: itemId, service, sender: item.sender || null, kind: item.kind || "message" },
-  });
-
   try {
-    // Enrich item with channel-type metadata for directed-message detection
-    const channelStr = (item.channel || "").toLowerCase();
-    const channelId = item.channel_id || "";
-    const isDm = channelStr.startsWith("dm/") || channelId.startsWith("D");
-    const myFirstName = loadAgent().firstName || "Agent";
-    const agentThreadRegex = new RegExp(`^${myFirstName}:`, "m");
-    const agentInThread = !!(item.thread_context && agentThreadRegex.test(item.thread_context));
-    item.is_dm = isDm;
-    item.agent_in_thread = agentInThread;
+    const isDm = item.is_dm === true;
+    // Carry the routing decision on the item so everything downstream of here —
+    // the prompt builder, the spawned session, the responder's log rows — can
+    // see which obligation and which rung this turn is serving. Without it the
+    // session has no idea it is discharging a planned obligation.
+    if (routed) item.execution = routed;
 
     // Classify via Haiku API
     const classResult = await _classify({
@@ -287,7 +359,7 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
       subject: item.subject || "",
       is_dm: isDm,
       is_group: !isDm && service === "slack",
-      agent_in_thread: agentInThread,
+      agent_in_thread: item.agent_in_thread === true,
       kind: item.kind || "message",
     });
 
@@ -305,7 +377,7 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
     // Skip ignored items
     if (classResult.category === "ignore" || classResult.action === "ignore") {
       markProcessed(item, service);
-      return;
+      return { ok: true, path: "ignored", reason: "classifier_ignore" };
     }
 
     // DIRECTED-MESSAGE GATE: In channels and group chats, only respond to
@@ -316,8 +388,6 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
     //   1. If LLM says NOT directed → verify with rules (catch missed @mentions, CEO, DMs)
     //   2. If LLM says directed BUT it's a non-DM channel → verify with rules (catch over-eager LLM)
     if (service === "slack") {
-      const isDm = item.is_dm || (item.channel || "").startsWith("dm/") || (item.channel_id || "").startsWith("D");
-
       if (!classResult.directed_at_agent) {
         // LLM says not directed — double-check with rule-based heuristics
         // to catch clear signals the LLM may have missed (DM, CEO, @mention)
@@ -335,7 +405,7 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
             summary: classResult.summary,
           });
           markProcessed(item, service);
-          return;
+          return { ok: true, path: "filtered", reason: "not_directed_at_agent" };
         }
         // Rule-based says directed — override LLM
         console.log(`[daemon] Directed-message override: LLM said not directed but rule-based detected direction (${item.sender} in ${item.channel})`);
@@ -364,7 +434,7 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
             summary: classResult.summary,
           });
           markProcessed(item, service);
-          return;
+          return { ok: true, path: "filtered", reason: "llm_over_eager_directed" };
         }
       }
     }
@@ -401,7 +471,7 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
             deferred: deferred > 0,
             reason: `thread_dedup: ${threadCheck.reason}`,
           });
-          return;
+          return { ok: true, path: "deferred", reason: `thread_dedup: ${threadCheck.reason}` };
         }
       }
     }
@@ -428,18 +498,27 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
           summary: classResult.summary,
         });
         markProcessed(item, service);
-        return;
+        return { ok: true, path: "claim_denied", reason: claim.reason };
       }
     }
 
     // QUICK REPLY PATH: Direct responses via API + Slack/Gmail posting.
     // No claude --print session needed. ~4-8 seconds total.
-    if (_isQuickReply(classResult)) {
+    //
+    // The ladder's RUNG is a veto here, never a promotion. `isQuickReply` is a
+    // judgement about the classifier's output; the rung is a judgement about the
+    // work the matched obligation actually needs. Rung 0/1 (a single protocol
+    // call, or a bounded skill) is what the in-process responder IS. Rung ≥2
+    // (plugin / session / workflow / team) means the answer needs machinery this
+    // path does not have, so a quick reply would be a wrong answer delivered
+    // fast. With no routing decision (an item the ladder could not place) this
+    // is exactly today's behaviour.
+    if (_isQuickReply(classResult, routed)) {
       console.log(`[daemon] Quick reply path for ${item.sender} (${classResult.model})`);
-      const result = await _sendQuickResponse(item, classResult);
+      const result = await _sendQuickResponse(item, classResult, routed);
       if (result.sent) {
         markProcessed(item, service);
-        return;
+        return { ok: true, path: "quick_reply", reason: classResult.model };
       }
       // If quick reply failed to send or was blocked by validation, fall through to dispatch a full session
       const reason = result.blocked ? `validation blocked: ${result.issues?.map(i => i.rule).join(", ")}` : "send failed";
@@ -509,11 +588,450 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
       },
     });
     recordSession(false); // spawned
+    return { ok: true, path: "session", reason: classResult.action };
 
   } catch (err) {
     console.error(`[daemon] Failed to process item ${itemId}:`, err.message);
     recordClassification(false);
     emitEvent({ type: EVENT_TYPES.ERROR, trace_id, attrs: { item_id: itemId, service, stage: "process_item", error: err.message } });
+    return { ok: false, path: "error", reason: err.message };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// THE EXECUTION LADDER — intake → match → route → drive → journal
+// ---------------------------------------------------------------------------
+//
+// Every inbound item now enters here BEFORE the classifier. What that buys, in
+// order of how much it was costing us to not have it:
+//
+//   * An `ignore` is a decision with a written reason, not an absence. Ambient
+//     channel chatter is dropped without a Haiku call and WITH a journal row
+//     saying why. An agent that answers everything is as broken as one that
+//     answers nothing, and until now nothing recorded the difference.
+//   * A board task assigned to this seat is WORK, not conversation. The surface
+//     policy says `latency: queue`, so it lands in state/queues/inbound.yaml —
+//     which the backlog sweep below already reads — instead of provoking an
+//     immediate reply into a comment thread nobody is watching.
+//   * A reply that is genuinely owed is routed to a RUNG before it is answered,
+//     so a single protocol call is not billed as a Claude session.
+//   * Ping-pong, dedupe and per-actor flood guards run off the journal, so two
+//     agents cannot spiral and one loud actor cannot monopolise the seat.
+//
+// FAIL-OPEN, NEVER SILENT. Any failure inside this function returns
+// `{handled:false}` and the item takes exactly the path it took before the
+// ladder existed. Every such fall-through logs the reason.
+
+/**
+ * Escape hatch. Read per call, not at module load, so an operator can turn the
+ * ladder off on a wedged machine without a restart. Taking it logs, loudly,
+ * exactly what is being turned off.
+ */
+function ladderEnabled() {
+  return process.env.DAEMON_EXECUTION_LADDER !== "0";
+}
+let _ladderDisabledWarned = false;
+
+/** REACT obligations from config/plan.yaml, re-read at most every 60s. */
+let _obligationsCache = null;
+const OBLIGATIONS_TTL_MS = 60_000;
+
+async function ladderObligations(log) {
+  const now = Date.now();
+  if (_obligationsCache && now - _obligationsCache.at < OBLIGATIONS_TTL_MS) {
+    return _obligationsCache.obligations;
+  }
+  const loaded = await loadReactObligations(AGENT_REPO_DIR);
+  if (loaded.degraded) {
+    // Not fatal — an un-adopted agent legitimately has no plan — but it pins the
+    // whole reactive lane at rung ≤1, so it must be visible.
+    log("warn", `[execution] no compiled REACT obligations (${loaded.reason}) — every event routes at rung ≤1`);
+  }
+  _obligationsCache = { at: now, obligations: loaded.obligations || [] };
+  return _obligationsCache.obligations;
+}
+
+/** For tests: drop the cached plan so a fresh config/plan.yaml is re-read. */
+export function _resetLadderCaches() {
+  _obligationsCache = null;
+  _ladderDisabledWarned = false;
+}
+
+/** The seat's org member id — the `me` every directedness join is relative to. */
+function ladderMemberId() {
+  const cfg = daemonOrgCfg();
+  return (
+    process.env.COHORT_AGENT_ID ||
+    (cfg && cfg.org && cfg.org.cohort && cfg.org.cohort.agentId) ||
+    ""
+  );
+}
+
+/**
+ * The routing NEED estimate for an inbound item, from what is knowable BEFORE
+ * the classifier runs.
+ *
+ * This matters more than it looks. `baseRung` demands `paramsKnown === true` for
+ * rung 0, and with no need at all every event lands on "no lower predicate held
+ * → bounded session" — rung 3, for a two-line DM. The first live run of this
+ * wiring did exactly that: it routed every DM to rung 3, which vetoed the quick
+ * reply, which turned a 4-second answer into a spawned Claude session. That is a
+ * regression dressed as a routing decision.
+ *
+ * What the daemon honestly knows pre-classification is the ADDRESSING: for a
+ * conversational surface it already has the channel and the thread, so the reply
+ * really is one protocol method whose parameters are in hand — the only unknown
+ * is the text, and generating the text is what the mechanism at rung 0/1 does.
+ * When the target CANNOT be resolved, `paramsKnown` is false and the ladder
+ * correctly walks up to a session that can go and find it.
+ *
+ * Everything else — is this open-ended research, how many steps — is the
+ * classifier's judgement, which runs after this and is still consulted by
+ * `isQuickReply`. So this estimate is a floor, never a ceiling: the obligation's
+ * own declared need and the failure walk-up both raise it from here.
+ *
+ * @param {object} item
+ * @returns {object} a `lib/execution/route.mjs` Need
+ */
+export function ladderNeed(item) {
+  const target = item.channel_id || item.thread_id || item.raw_ref || item.channel || null;
+  return {
+    paramsKnown: !!target,
+    steps: 1,
+    filesystem: false,
+    openEnded: false,
+  };
+}
+
+/**
+ * Ignore reasons where the ladder is saying "this is not addressed to me".
+ *
+ * ONLY these consult the rule-based `isDirectedAtAgent` override. The other
+ * ignore reasons — `duplicate`, `own_echo`, `reply_chain_depth`, `actor_flood`,
+ * `emergency_stop`, `halt`, `mandate_stale`, `paused` — are GUARDS, deliberate
+ * decisions taken about an event the ladder understood perfectly well. Letting
+ * the rule check override those would defeat every one of them: a DM is always
+ * "directed", so `duplicate` would never hold and the agent would answer the
+ * same message on both the push and the poll delivery. The first live run of
+ * this wiring did precisely that.
+ */
+const DIRECTEDNESS_IGNORE_REASONS = new Set(["ambient_channel", "not_directed"]);
+
+/**
+ * Ignore reasons meaning the ladder could not UNDERSTAND the item at all. These
+ * always fall through to the classifier path — the ladder has no opinion to
+ * enforce, and dropping the item on the strength of its own confusion is how a
+ * message gets lost.
+ */
+const UNINTERPRETABLE_IGNORE_REASONS = new Set([
+  "not_classified",
+  "no_verdict",
+  "unknown_surface",
+  "unrecognised_shape",
+  "intake_error",
+  "not_an_object",
+]);
+
+/** Cooperative kill switches the disposition layer reads. */
+function ladderRuntime() {
+  const runtime = {};
+  try {
+    if (_existsSync(join(AGENT_REPO_DIR, ".emergency-stop")) || _existsSync(join(AGENT_REPO_DIR, "state", "EMERGENCY_STOP"))) {
+      runtime.emergencyStop = true;
+    }
+  } catch (err) {
+    console.warn(`[execution] could not read the emergency-stop marker (${err.message}) — assuming not stopped`);
+  }
+  return runtime;
+}
+
+/**
+ * Thread arbitration for the ladder.
+ *
+ * The org lease (`preSendArbitration`) is the right answer for a Cohort space,
+ * where several agent seats really can see the same thread. It is the WRONG
+ * answer for Slack/Gmail, where this daemon is the only agent on the account and
+ * the real duplicate-answer risk is two of its own sessions — which the existing
+ * `acquireThreadLock` already handles inside `answerItem`. Taking the org lease
+ * here for a Slack thread would also double-lock: the ladder would win it and
+ * `answerItem` would then defer its own item.
+ *
+ * So: org surfaces arbitrate for real, channel surfaces say so out loud and
+ * leave it to the lock that already works.
+ */
+async function ladderArbitrate({ decision, candidate, resource }) {
+  const family = String((candidate && candidate.family) || "");
+  const orgFamilies = ["messaging", "board", "calling", "files", "calendar", "approval", "decision", "escalation", "handoff", "email"];
+  if (!orgFamilies.includes(family)) {
+    console.log(
+      `[execution] ${family || "channel"} thread ${decision.thread} is arbitrated by the daemon's own thread lock, not an org lease`,
+    );
+    return { ok: true, ref: { mayReply: true, by: "daemon_thread_lock" }, error: null };
+  }
+  const { preSendArbitration } = await import("../../lib/org/leases.mjs");
+  const ids = (candidate && candidate.ids) || {};
+  const r = await preSendArbitration({
+    platform: "cohort",
+    channel: ids.channelId || resource || decision.thread || "",
+    thread: ids.threadRootId || ids.threadId || ids.messageId || "",
+    agentRoot: AGENT_REPO_DIR,
+  });
+  return { ok: true, ref: r, error: null };
+}
+
+/**
+ * The blast-radius gate, with the seat's own self-approval authority applied.
+ *
+ * `email` and `calendar` carry the `external` action class, so §8 wants an
+ * approval card before either runs. Both surfaces ALSO carry `selfApprove:true`
+ * — the surface policy's own statement that this seat may be the terminal
+ * authority on them. Routing every outbound email through a human card by
+ * default would take an agent that has been answering mail unsupervised for
+ * months and silently park its replies behind an approval nobody is watching for
+ * — the exact "responds to nothing" failure, arrived at through a safety
+ * feature.
+ *
+ * So: a self-approvable surface is self-approved, LOUDLY, naming the classes.
+ * A surface the policy says the seat may NOT self-approve (`selfApprove:false`)
+ * never reaches here — `decide` escalates it at step 6 instead. Set
+ * `DAEMON_LADDER_APPROVALS=1` to route self-approvable surfaces through the real
+ * org approval flow as well.
+ */
+async function ladderRequestApproval(args) {
+  const { decision, classes } = args;
+  const policy = policyFor(decision && decision.surface);
+  const human = process.env.DAEMON_LADDER_APPROVALS === "1";
+  if (!human && policy.selfApprove === true) {
+    console.warn(
+      `[execution] ${decision.surface} action is classed ${(classes || []).join("+")} (approval-gated by §8), but the ` +
+        `${decision.surface} surface policy grants this seat self-approval → proceeding without a human card. ` +
+        "Set DAEMON_LADDER_APPROVALS=1 to require one.",
+    );
+    counters.bump("execution.self_approved", { surface: decision.surface, classes: (classes || []).join("+") });
+    return { ok: true, ref: { granted: true, selfApproved: true, classes }, error: null };
+  }
+  const real = defaultEffects({ agentRoot: AGENT_REPO_DIR, me: ladderMemberId() }).requestApproval;
+  return real(args);
+}
+
+/**
+ * The `schedule` effect, with ONE carve-out this daemon has to make honestly.
+ *
+ * A queue row in `state/queues/inbound.yaml` is drained by `sweepBacklog`, which
+ * dispatches a session from the row's `next_action` text. That is the right
+ * shape for WORK — a task assigned, a call invite, an RSVP, a budget-exhausted
+ * deferral: the row says what to do and nothing was lost. It is the WRONG shape
+ * for a conversation somebody is waiting on, because the row carries no thread
+ * context, no sender and no message body. Batching an email or a board comment
+ * through it would answer later AND worse.
+ *
+ * So `batch_surface` — the only schedule reason that fires on a surface the
+ * daemon can already answer live — does not queue. It hands the item back to the
+ * classifier path, and says so in the journal (`queued:false`) rather than
+ * writing a row that would look drained and never be.
+ *
+ * THIS IS A SEVERED HOP, NAMED: when the backlog drain learns to re-hydrate the
+ * originating inbox item, this carve-out should be deleted and `email` /
+ * `task_comment` should batch as their surface policy says they should.
+ */
+async function ladderSchedule({ decision, candidate, item }) {
+  if (decision && decision.reason === "batch_surface") {
+    console.warn(
+      `[execution] ${decision.surface} is a batch surface, but the backlog drain cannot re-hydrate the ` +
+        "originating item (no thread context in a queue row) — answering it live instead of queueing. " +
+        "Decision journalled; the batching is advisory until the drain carries the item.",
+    );
+    return { ok: true, ref: { queued: false, handedTo: "classifier_path", surface: decision.surface }, error: null };
+  }
+  // The candidate carries the entity id and the item carries the subject/body.
+  // Without both the row the sweep drains names no thing to act on — which is
+  // exactly how a real calendar invite reached a queue row that no session
+  // could RSVP. See `scheduleToQueue`.
+  return scheduleToQueue(decision, { agentRoot: AGENT_REPO_DIR, candidate, item });
+}
+
+/**
+ * Run one inbound item through the execution ladder.
+ *
+ * @param {object} item     the poller inbox item, already enriched
+ * @param {string} service
+ * @param {string} itemId
+ * @param {string} trace_id
+ * @param {object} [deps]   test seams; `deps.processOne` / `deps.answerItem`
+ *                          replace the real pipeline / the real classifier path.
+ * @returns {Promise<{handled:boolean, decision:object|null, reason:string, answered:object|null}>}
+ */
+export async function runExecutionLadder(item, service, itemId, trace_id, deps = {}) {
+  const _answer = deps.answerItem || answerItem;
+  const _processOne = deps.processOne || processOne;
+  const _ruleDirected = deps.isDirectedAtAgent || isDirectedAtAgent;
+
+  if (!ladderEnabled()) {
+    if (!_ladderDisabledWarned) {
+      _ladderDisabledWarned = true;
+      console.warn(
+        "[execution] DAEMON_EXECUTION_LADDER=0 — intake/match/route/journal are OFF. " +
+          "Every item goes straight to the classifier: no directedness journal, no obligation binding, " +
+          "no rung, no queue for board work, and no record of what was ignored or why.",
+      );
+    }
+    return { handled: false, decision: null, reason: "ladder_disabled", answered: null };
+  }
+
+  const log = (level, msg) => {
+    if (level === "error") console.error(`[execution] ${msg}`);
+    else if (level === "warn") console.warn(`[execution] ${msg}`);
+    else if (level === "debug") { /* per-rule match trace — logEvent only */ }
+    else console.log(`[execution] ${msg}`);
+  };
+
+  let answered = null;
+  try {
+    const me = ladderMemberId();
+    const obligations = await ladderObligations(log);
+
+    // `react_now` means: answer it, now, with the machinery the rung names. The
+    // daemon's classifier → quick-reply/session path IS that machinery, so the
+    // effect drives it rather than duplicating it. This is the hop that was
+    // missing: `defaultEffects` documents `react` as caller-supplied and every
+    // previous caller supplied nothing, so react_now was decided and dropped.
+    const react = async ({ decision }) => {
+      answered = await _answer(item, service, itemId, trace_id, deps, decision);
+      return {
+        ok: answered && answered.ok !== false,
+        ref: {
+          rung: decision.rung,
+          mechanism: decision.mechanism,
+          path: answered ? answered.path : null,
+          reason: answered ? answered.reason : null,
+        },
+        error: answered && answered.ok === false ? answered.reason || "answer failed" : null,
+      };
+    };
+
+    const effects = {
+      ...defaultEffects({ agentRoot: AGENT_REPO_DIR, me, react }),
+      arbitrate: ladderArbitrate,
+      schedule: ladderSchedule,
+      requestApproval: ladderRequestApproval,
+    };
+
+    const res = await _processOne({
+      item,
+      me,
+      agentRoot: AGENT_REPO_DIR,
+      runtime: ladderRuntime(),
+      need: ladderNeed(item),
+      obligations,
+      effects,
+      traceId: trace_id,
+      log,
+    });
+
+    const d = res.decision || null;
+    if (!d) {
+      console.warn(`[execution] ${itemId} produced no decision — falling through to the classifier path`);
+      return { handled: false, decision: null, reason: "no_decision", answered: null };
+    }
+
+    logEvent("execution", {
+      item_id: itemId,
+      service,
+      trace_id,
+      origin: res.origin,
+      surface: d.surface,
+      tier: d.tier,
+      disposition: d.disposition,
+      reason: d.reason,
+      rung: d.rung,
+      mechanism: d.mechanism,
+      obligation_key: res.obligationKey,
+      proposed: res.proposed,
+      effect: res.effect,
+      ok: res.ok,
+      degraded: d.degraded,
+      why: d.why,
+    });
+    console.log(
+      `[execution] ${itemId}: ${res.origin} → ${d.surface || "?"} → ${d.disposition}` +
+        (Number.isFinite(d.rung) ? ` @rung ${d.rung} (${d.mechanism})` : "") +
+        ` — ${d.reason}` +
+        (res.obligationKey ? ` [${res.obligationKey}]` : " [uncovered]"),
+    );
+
+    // ── ignore: a first-class, journalled outcome ─────────────────────────
+    if (d.disposition === "ignore") {
+      // The ladder did not understand the item. It has no opinion worth
+      // enforcing, so the classifier path decides — exactly as before.
+      if (UNINTERPRETABLE_IGNORE_REASONS.has(d.reason)) {
+        console.warn(
+          `[execution] ${itemId} could not be placed by intake (${d.reason}) — no ladder opinion, ` +
+            "falling through to the classifier path",
+        );
+        counters.bump("execution.uninterpretable", { item_id: itemId, reason: d.reason });
+        return { handled: false, decision: d, reason: `uninterpretable:${d.reason}`, answered: null };
+      }
+      // The safety interlock, scoped to the ONE question it is competent to
+      // answer: "is this addressed to me?". `isDirectedAtAgent` is the
+      // rule-based check the classifier path has always applied, and it knows
+      // things intake does not — the CEO privilege flag, the agent's own display
+      // name in free text, "this arrived in my mailbox". Where the two disagree
+      // about ADDRESSING we do not gag the agent; we fall through, loudly.
+      //
+      // It is deliberately NOT consulted for the guard reasons. See
+      // DIRECTEDNESS_IGNORE_REASONS.
+      if (DIRECTEDNESS_IGNORE_REASONS.has(d.reason) && _ruleDirected(item)) {
+        console.warn(
+          `[execution] directedness disagreement on ${itemId}: ladder says ignore (${d.reason}), ` +
+            "rule-based check says this IS directed at me → falling through to the classifier path",
+        );
+        counters.bump("execution.directedness_disagreement", { item_id: itemId, reason: d.reason });
+        return { handled: false, decision: d, reason: "rule_override", answered: null };
+      }
+      markProcessed(item, service);
+      return { handled: true, decision: d, reason: `ignore:${d.reason}`, answered: null };
+    }
+
+    // ── react_now: the classifier path already ran inside the effect ──────
+    if (answered) {
+      return { handled: true, decision: d, reason: `answered:${answered.path}`, answered };
+    }
+
+    // ── a batch surface the drain cannot re-hydrate: answer it live ──────
+    if (d.disposition === "schedule" && res.ref && res.ref.handedTo === "classifier_path") {
+      return { handled: false, decision: d, reason: "batch_surface_handed_back", answered: null };
+    }
+
+    // ── the effect ran and did NOT reach the classifier path ─────────────
+    // schedule (queued to state/queues/inbound.yaml, which sweepBacklog reads),
+    // delegate (handoff), escalate — or a react_now that a gate stood down
+    // (approval pending, another agent holds the thread). All are complete
+    // decisions with a journal row. The item is done for this pass.
+    if (res.ok !== false) {
+      markProcessed(item, service);
+      return { handled: true, decision: d, reason: `${d.disposition}:${res.effect || "none"}`, answered: null };
+    }
+
+    // The effect FAILED. Do not silently drop a directed event because a queue
+    // write or a handoff RPC broke — fall through so the classifier path still
+    // gives the sender an answer.
+    console.error(
+      `[execution] ${d.disposition} effect failed for ${itemId} (${res.error || "unknown"}) — ` +
+        "falling through to the classifier path so the item is not lost",
+    );
+    return { handled: false, decision: d, reason: `effect_failed:${res.error || "unknown"}`, answered: null };
+  } catch (err) {
+    // A bug in the ladder must never cost the user their message.
+    console.error(
+      `[execution] ladder threw on ${itemId} (${err && err.message ? err.message : err}) — ` +
+        "falling through to the classifier path",
+    );
+    emitEvent({
+      type: EVENT_TYPES.ERROR,
+      trace_id,
+      attrs: { item_id: itemId, service, stage: "execution_ladder", error: err && err.message ? err.message : String(err) },
+    });
+    return { handled: false, decision: null, reason: "ladder_threw", answered: null };
   }
 }
 
@@ -897,14 +1415,50 @@ async function sweepBacklog() {
     let dispatched = 0;
 
     for (const queueItem of toDispatch) {
+      // ── THE RUNG REACHES THE EXECUTOR ────────────────────────────────────
+      // The goal steward routes every self-directed item through
+      // `lib/execution/route.routeRung`, audits the decision, and writes
+      // `rung:` into `state/queues/goals.yaml`. Nothing downstream read it: the
+      // sweep sized every session off `priority` alone, so a rung-5
+      // subagent-fanout and a rung-0 single tool call got the identical plain
+      // Sonnet turn. The router's cost/blast-radius decision died on disk.
+      //
+      // What the drain can honour today is the SIZE of the turn and the framing
+      // the session sees. What it cannot honour is a mechanism that is not "spawn
+      // a session" — that is named below rather than silently ignored.
+      const rung = Number.isFinite(queueItem.rung) ? queueItem.rung : null;
+      const mechanism = rung != null ? RUNG_MECHANISM[rung] || null : null;
+      if (mechanism) queueItem.mechanism = mechanism; // read by buildBacklogContext
       const classResult = {
         priority: queueItem.priority,
-        action: "queue",
-        model: queueItem.priority === "critical" ? "opus" : "sonnet",
+        // `execute`, NOT `queue`. This row IS the queue; the sweep is what
+        // drains it. `action:"queue"` sent every drained session the inbox-turn
+        // instruction "this item needs tracking but not immediate action" —
+        // so the drain politely re-filed its own backlog forever. See
+        // ACTION_INSTRUCTIONS.execute in prompt-builder.mjs.
+        action: "execute",
+        // Rung 4/5 (workflow-runner, subagent-fanout) are the open-ended, many-step
+        // rungs — those get the stronger model regardless of the declared priority.
+        model: queueItem.priority === "critical" || (rung != null && rung >= 4) ? "opus" : "sonnet",
         summary: queueItem.title,
         category: "action_required",
+        rung,
+        mechanism,
       };
 
+      if (rung != null && rung <= 1) {
+        // SEVERED HOP, NAMED: rungs 0-1 mean "one method call / one skill, params
+        // known" — seconds of work. The backlog drain has exactly one mechanism
+        // (spawn a session), so it overpays for these. Nothing is lost or wrong;
+        // it is slower and dearer than the router asked for, and an operator has
+        // to be able to see that rather than infer it from a bill.
+        console.warn(
+          `[daemon] Backlog "${queueItem.title}" routed to rung ${rung} (${mechanism}), but the backlog drain ` +
+            "can only spawn a session — running it as a session anyway. The rung is honoured for framing and " +
+            "model choice only.",
+        );
+      }
+
       const prompt = await buildPrompt(null, classResult, {
         type: "backlog",
         queueItem,