@coreplane/switchboard 1.244.0 → 1.245.0

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -81,7 +81,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import type { DirectoryBackup, SandboxCommand } from "@cloudflare/sandbox";
 import { createExtensionProcessSandbox } from "@cloudflare/sandbox/extensions";
 import { DurableObject } from "cloudflare:workers";
-import { BASH_TIMEOUT_MAX_MS, BASH_TIMEOUT_MS, clampBashTimeout } from "../../src/execution/bashTimeout.js";
+import { BASH_TIMEOUT_MAX_MS, clampBashTimeout } from "../../src/execution/bashTimeout.js";
 import { selectBindingsToPurge } from "../../src/execution/bindingPurge.js";
 import { busyAfterKillReason, planForceDetach } from "../../src/execution/residentDetach.js";
 import { parseReadonly, planReadonlyAttach } from "../../src/execution/residentReadonly.js";
@@ -323,6 +323,16 @@ import {
 } from "../../src/execution/residentDepsStore.js";
 import { buildId, injectedBuildStamp } from "../../src/deploy/buildStamp.js";
 import { createRefreshInstance, createRefreshInstanceNow, type RefreshInstanceParams } from "./refresh";
+import {
+  ControlResetError,
+  RuntimeReplacedError,
+  controlResetErr,
+  execFailureDocument,
+  runtimeReplacedErr,
+  selfAndCauses,
+  threadErrBuilders,
+  type ThreadErr,
+} from "./threadErr";
 import {
   DEFAULT_EXEC_TIMEOUT_MS,
   DEPS_STEP_OVERHEAD_MS,
@@ -621,9 +631,11 @@ const ATTACH_MUTEX_WAIT_MS = 60_000;
  *  stays far inside the bot's 45-min run budget. Work beyond 20 minutes
  *  belongs in background jobs.
  *
- *  /op runs (test/build) keep the flat 5-minute budget — the deterministic op
- *  path has no caller-supplied knob, so nothing may stretch it. */
-const OP_EXEC_TIMEOUT_MS = BASH_TIMEOUT_MS;
+ *  /op runs (test/build) get the flat 20-minute ceiling — the deterministic op
+ *  path has no caller-supplied knob, and a repo's full suite routinely outlives
+ *  the 5-minute per-command default; the client bounds its /op wait at the same
+ *  ceiling, so the two ends agree. */
+const OP_EXEC_TIMEOUT_MS = BASH_TIMEOUT_MAX_MS;
 /** Sanity bound on /exec's command body — a guard against a runaway caller,
  *  not a working limit: legitimate agent one-liners (heredocs writing test
  *  files, `node -e` scripts, long pipelines) run well past the old 8 000 and
@@ -674,70 +686,10 @@ export function validateEnvNames(vars: Record<string, string>): void {
   }
 }
 
-/** The resident runtime (the Sandbox SDK's control session to the container)
- *  was replaced while a command was in flight — in practice a `wrangler deploy`
- *  swapping this DO's isolate mid-run (which otherwise surfaces as a fake
- *  "OOM" on the run). `phase` says where the SDK failed: `"spawn"`
- *  (the start RPC itself; the SDK never proves the process did NOT start) or
- *  `"collect"` (a `StaleProcessHandleError` on an already-running process). In
- *  both cases the command may have run, so the resident never re-issues it;
- *  the thread routes answer the NAMED `runtime-replaced` error and the client
- *  decides (idempotent read/write retry; exec is handed to the model). */
-class RuntimeReplacedError extends Error {
-  constructor(
-    /** Where the replacement was met: the command's spawn, its collect, or
-     *  the Worker's call into the Durable Object itself (`threadRejectionErr`),
-     *  before the method could answer. */
-    readonly phase: "spawn" | "collect" | "call",
-    readonly cause: unknown,
-    /** Whether the replacement was KNOWN where the failure was classified
-     *  (`replacementKnown`): the SDK vouched the runtime moved, or a restore is
-     *  under way for this resident. One decision, made once at the exec choke
-     *  point, and it gates the word on `/exec` alone (`replacedExecAnswer`) —
-     *  the incarnation swap is unconditional there. Unknown, the failure only
-     *  says the container is down or the transport was lost — a merely asleep
-     *  or starting container, or a network blip, say the same — so the answer
-     *  is the SDK's words and the harness's one more command decides. At the
-     *  Worker's call nothing vouched, so it is `false` there. */
-    readonly known: boolean,
-  ) {
-    super(
-      `runtime-replaced: the resident runtime was replaced (a deploy) while this command was ${
-        phase === "spawn" ? "starting" : phase === "collect" ? "running" : "pending at the Worker"
-      }; its output is lost (${errMsg(cause)})`,
-    );
-    this.name = "RuntimeReplacedError";
-  }
-}
-
-/** The resident's own Durable Object was reset while a command was in flight —
- *  a `wrangler deploy` of the Worker code (not the container image) supersedes
- *  this DO's isolate, so the SDK's control session to the container is lost
- *  mid-command (`isDurableObjectCodeUpdateReset`). This is NOT a runtime
- *  replacement: the container and every process the run holds in it are exactly
- *  as they were — only the DO that was driving them reset. The command's
- *  outcome is unknown (the reset may have raced its start or its finish), so
- *  the resident never re-issues it here; the thread routes answer the NAMED
- *  `control-reset` error and the client re-sends an idempotent op or resolves a
- *  write by pi's echo (docs/reference/specs/harness-pi.md item 16). Distinct
- *  from `RuntimeReplacedError` precisely so the harness never mistakes a DO
- *  reset over a live pi for a replaced container and orphans that pi. */
-class ControlResetError extends Error {
-  constructor(
-    /** Where the reset was met: the command's spawn, its collect, or the
-     *  Worker's call into the Durable Object itself (`threadRejectionErr`),
-     *  before the method could answer. */
-    readonly phase: "spawn" | "collect" | "call",
-    readonly cause: unknown,
-  ) {
-    super(
-      `control-reset: the resident's Durable Object was reset (a deploy) while this command was ${
-        phase === "spawn" ? "starting" : phase === "collect" ? "running" : "pending at the Worker"
-      }; the container and its processes are as they were; the command's outcome is unknown (${errMsg(cause)})`,
-    );
-    this.name = "ControlResetError";
-  }
-}
+// `RuntimeReplacedError`, `ControlResetError`, the `ThreadErr` shape and the
+// builders that answer a throw no route named live in ./threadErr.ts, pure
+// over `(err, route)` so plain Node runs them; this entry hands them the
+// predicates only it can supply (`threadErrBuilders`, below the predicates).
 
 /** Every wording the pinned SDK (@cloudflare/sandbox@0.13.0-next.751.1) uses
  *  when the runtime incarnation changed under a call, for the message-based
@@ -755,17 +707,6 @@ class ControlResetError extends Error {
 // port-ready bound. Both take the message fallback below; neither has a typed
 // class to match.
 
-/** `err` and its `cause` chain, bounded like the SDK's own `selfAndCauses`
- *  walker: the SDK wraps platform errors, so the telling message can sit one or
- *  two links down. */
-function* selfAndCauses(err: unknown): Generator<unknown> {
-  let current = err;
-  for (let depth = 0; depth < 8 && current != null; depth++) {
-    yield current;
-    current = typeof current === "object" ? (current as { cause?: unknown }).cause : undefined;
-  }
-}
-
 /** `OperationInterruptedError` reasons that mean the runtime under the call is
  *  gone and a new one serves the thread: a deploy swapped the isolate
  *  (`runtime_replaced`), the sandbox's lifetime epoch moved
@@ -848,107 +789,17 @@ function sdkVouchesRuntimeMoved(err: unknown): boolean {
   return false;
 }
 
-/** The platform's transient sentences the pinned SDK's own predicate does not
- *  name — `isPlatformTransientError` covers the code-update reset, a lost
- *  connection, the storage-startup reset and the typed `retryable` flag, so
- *  those are read from the SDK, never from a string table of ours. Two remain:
- *  the Durable Object reset by a storage operation that did not complete (the
- *  platform's `Durable Object storage operation exceeded timeout which caused
- *  object to be reset.` — an assumption about the platform's text, carried
- *  from the first typing of the catch-all, not in the SDK's source), and the
- *  Durable Object overloaded. The SDK's retry predicate EXCLUDES the overloaded
- *  sentence (`isErrorRetryable`: an in-process retry only adds to a queue that
- *  is full); it is typed transient here because the client's
- *  `worker-unavailable` is a re-probe after the harness's bounded wait
- *  (`replacedVerdict`, `PROBE_WAIT_MAX_MS`), never a tight retry, and a full
- *  queue drains. The platform's sentences alone — a bare `internal error` or
- *  `overloaded` is a word a git or GitHub failure carries too, and a throw
- *  typed transient by it would be re-probed for a restore window that never
- *  clears it. */
-const TRANSIENT_PLATFORM_WORDING = /storage operation|durable object is overloaded/i;
-
-/** The platform's own transient that no route word names — what is left once
- *  `threadRejectionErr` has answered a reset and a replacement by their words:
- *  the container's runtime unreachable (`isRuntimeUnreachable`: the SDK's
- *  connect abort by its `AbortError` name or its exact sentence —
- *  `RUNTIME_UNREACHABLE_WORDING` is anchored to the whole message, so a
- *  `TimeoutError`'s `The operation was aborted due to timeout`, the text a
- *  route's own `AbortSignal.timeout` on a slow GitHub raises, never matches),
- *  the pinned SDK's own platform-transient predicate (`isPlatformTransientError`:
- *  the code-update reset, a lost connection, the storage-startup reset, the
- *  typed `retryable` flag — the SDK's signal, read as it reads it), and the
- *  remainder sentences above, anywhere in the cause chain. */
-function isUnnamedPlatformTransient(err: unknown): boolean {
-  if (isRuntimeUnreachable(err) || isPlatformTransientError(err)) return true;
-  for (const link of selfAndCauses(err)) {
-    if (link instanceof Error && TRANSIENT_PLATFORM_WORDING.test(link.message)) return true;
-  }
-  return false;
-}
-
-/** Whether a throw no route named is the platform's own transient — the
- *  Durable Object reset by a deploy (`isControlReset`), the runtime replaced
- *  under the call (`isRuntimeReplacement`), or the transient no word names
- *  (`isUnnamedPlatformTransient`) — against a deterministic throw in the route
- *  itself (a bug, a bad argument). The client reads the answer's `transient`
- *  field to re-probe the first and judge the second at once (execution.md item
- *  9), never the words. */
-function isTransientPlatformThrow(err: unknown): boolean {
-  return isControlReset(err) || isRuntimeReplacement(err) || isUnnamedPlatformTransient(err);
-}
-
-/** The 500 for a throw no route named, at whichever catch met it — the fetch
- *  handler's catch-all, a streamed route's rejection mapper, a route's own
- *  catch around its body (`prefix`: `attach-failed`, `op-failed`): the words,
- *  and whether the throw was the platform's transient (`transient`), typed
- *  here so the client decides by a field and never by which catch met the
- *  throw. A failure a route DID name — a step that failed, a mirror held — is
- *  that route's own answer and never comes here. */
-function catchAllErr(err: unknown, prefix?: string): ThreadErr {
-  return unnamedThrowErr(err, isTransientPlatformThrow(err), prefix);
-}
-
-/** The one shape of that 500: the words, behind `prefix` where the route names
- *  itself, and the verdict `transient`, decided once by the caller — so a
- *  caller that has already settled the typed predicates (`threadRejectionErr`)
- *  hands its verdict in instead of walking the cause chain again. */
-function unnamedThrowErr(err: unknown, transient: boolean, prefix?: string): ThreadErr {
-  const words = errMsg(err);
-  return { error: prefix ? `${prefix}: ${words}` : words, status: 500, transient };
-}
-
-type ThreadDataRoute = "/exec" | "/read" | "/write";
-
-/** A thread data-plane route's pending Durable Object call that REJECTED —
- *  the stub, not the method: the DO reset by a code update before or while the
- *  method ran, a storage operation that did not complete, the runtime
- *  unreachable — answered as the DO answers the same fact when it catches it
- *  inside (`execThreadImpl`, the file methods). A control reset is the DO's
- *  own word, `control-reset` on a 409: the container and its processes are as
- *  they were and the command's outcome is unknown, so the client resolves it by
- *  its own rule and never waits on it as the resident unavailable. A runtime
- *  replacement is answered by route, as the methods answer it, with the DO's
- *  own gate (`replacementKnown`) applied as far as it reaches: its first half,
- *  the SDK vouching the runtime moved (`sdkVouchesRuntimeMoved`), judges the
- *  moved sentences that survive the stub boundary as text, so it is made here
- *  by the same rule; its other half, a restore under way (`knowsContainerGone`),
- *  is the DO's alone and out of reach. So on `/exec` the word is said where
- *  the SDK vouched and WITHHELD where only the DO could have — that gate's
- *  unknown branch, the SDK's words on a 409 with no word, for the harness's one
- *  more command to judge; on `/read` and `/write` the word is said either way
- *  (`runtimeReplacedErr`, unconditional there on purpose), since it drives the
- *  client's one re-attach-and-retry and never a verdict. Anything else is the
- *  typed 500, its `transient` decided here once the typed predicates are
- *  settled. */
-function threadRejectionErr(err: unknown, route: ThreadDataRoute): ThreadErr {
-  if (isControlReset(err)) return controlResetErr(new ControlResetError("call", err));
-  if (isRuntimeReplacement(err)) {
-    const known = sdkVouchesRuntimeMoved(err);
-    if (route === "/exec" && !known) return { error: errMsg(err), status: 409 };
-    return runtimeReplacedErr(new RuntimeReplacedError("call", err, known));
-  }
-  return unnamedThrowErr(err, isUnnamedPlatformTransient(err));
-}
+/** The 500 for a throw no route named and the thread data plane's rejection
+ *  mapping (threadErr.ts holds the rules; threadErr.test.ts runs them under
+ *  plain Node with the SDK's real sentences), built over the predicates only
+ *  this entry can supply: the SDK's reset and platform-transient predicates,
+ *  and the resident's own replacement classifier and vouch. */
+const { catchAllErr, threadRejectionErr } = threadErrBuilders({
+  isControlReset,
+  isRuntimeReplacement,
+  sdkVouchesRuntimeMoved,
+  isPlatformTransientError,
+});
 
 /** Whether a command's failure is the resident's own Durable Object resetting
  *  under it (a Worker-code deploy) rather than the container runtime being
@@ -960,31 +811,6 @@ function isControlReset(err: unknown): boolean {
   return isDurableObjectCodeUpdateReset(err);
 }
 
-/** The named ThreadErr every thread route (exec/read/write) answers for a
- *  runtime replacement, so the client can classify it (409 like the other
- *  recoverable thread states; `reason` is the discriminator). On `/exec` the
- *  answer goes through `replacedExecAnswer` first: the word only when the
- *  replacement was known where `run()` classified the failure. On
- *  `/read` and `/write` the word stays unconditional on purpose: those routes
- *  reach the same `run()` and can meet the same down wordings, but there the
- *  word drives the client's re-attach-and-retry (the attach is what wakes a
- *  container that is asleep or starting), never a verdict — nothing relaunches
- *  on it, and the harness never reads or writes through them (its seam runs
- *  every operation as an `/exec` script). Gating them would trade a spare
- *  re-attach for a read that fails outright while the container starts. */
-function runtimeReplacedErr(err: RuntimeReplacedError): ThreadErr {
-  return { error: err.message, status: 409, reason: "runtime-replaced" };
-}
-
-/** The named ThreadErr a DO code-update reset answers with — its own `reason`
- *  the client keys on, distinct from `runtime-replaced`: the container is
- *  unchanged and the command's outcome is unknown, so the client re-sends an
- *  idempotent op or resolves a write by echo (harness-pi item 16), never the
- *  replaced verdict. */
-function controlResetErr(err: ControlResetError): ThreadErr {
-  return { error: err.message, status: 409, reason: "control-reset" };
-}
-
 /** The container's control port never answered: `exec` rejected with the
  *  DOMException of the SDK's connect abort (`DEFAULT_CONNECT_TIMEOUT_MS`,
  *  30 s), raised inside its wake path — `RuntimeBootstrapProbe.probe` →
@@ -1308,36 +1134,6 @@ interface ThreadBinding {
   depsKey?: string;
 }
 
-/** Named, RPC-cloneable error shape for the thread data plane. The Worker
- *  maps `status` to the HTTP status; extra fields (`needs`, `state`,
- *  `reason`) ride along into the body. */
-interface ThreadErr {
-  error: string;
-  status: number;
-  /** Beside `state` on a 503 that carries the lifecycle state: the lifecycle
-   *  REASON (`getStatus().reason`), kept apart from `reason`, which is the
-   *  answer's own word (`mirror-busy`, `disk-pressure`, `image-stale`). The
-   *  client reads the pair to decide whether the resident is coming back
-   *  (execution.md item 9); reading `reason` there would take a busy mirror on
-   *  a degraded-but-serviceable resident for a repo failure. */
-  stateReason?: string;
-  /** On the 500 for a throw no route named (`unnamedThrowErr`, through
-   *  `catchAllErr` or `threadRejectionErr`: the fetch handler's catch-all, a
-   *  streamed route's rejection, a route's own catch around its body): whether
-   *  the throw it wrapped was the platform's own transient
-   *  (`isTransientPlatformThrow`) — a re-probe clears it — or a deterministic
-   *  throw in the route, judged at once. */
-  transient?: boolean;
-  /** The steps the request ran before it failed (docs/reference/specs/tracing.md item 19):
-   *  a failed attach's trace is the one that says which step blew the budget. */
-  trace?: ResidentStep[];
-  needs?: string;
-  /** With needs:"ref" — the resident's default branch, so the caller can bind by default. */
-  defaultRef?: string;
-  state?: ResidentState;
-  reason?: string;
-}
-
 interface AttachOk {
   workspace: string;
   ref: string;
@@ -8990,33 +8786,6 @@ function streamHeartbeatJson<T>(
   return new Response(stream, { headers: { "content-type": "application/json" } });
 }
 
-/** /exec's failure document, in the item-3 dual shape (`error` beside
- *  `stdout: ""`, `stderr`, `exitCode: 127`) so old and new executors both
- *  render it. The ThreadErr's fields ride beside the words, as the JSON routes
- *  carry them: `needs`; the lifecycle pair (`state`, `stateReason`); the
- *  answer's own word (`reason`, kept independent of `state` — `runtimeReplacedErr()`
- *  sets `reason: "runtime-replaced"` with NO state, and the client's
- *  deploy-vs-dead-transport check reads it); the answer's `status`; the
- *  catch-all's `transient`. The client types a streamed failure by these fields
- *  (execution.md item 9), and a document that dropped them would make every
- *  /exec failure a deterministic answer over HTTP 200. One builder for both of
- *  the stream's paths: a failure the Durable Object named, and a pending
- *  result that rejected. */
-function execFailureDocument(failure: ThreadErr): object {
-  return {
-    error: failure.error,
-    ...(failure.needs ? { needs: failure.needs } : {}),
-    ...(failure.state ? { state: failure.state } : {}),
-    ...(typeof failure.stateReason === "string" ? { stateReason: failure.stateReason } : {}),
-    ...(failure.reason ? { reason: failure.reason } : {}),
-    status: failure.status,
-    ...(typeof failure.transient === "boolean" ? { transient: failure.transient } : {}),
-    stdout: "",
-    stderr: failure.error,
-    exitCode: 127,
-  };
-}
-
 /** /exec's payload mapping: a result as {stdout, stderr, exitCode, truncated};
  *  a failure as `execFailureDocument` — the one the Durable Object named, or
  *  the pending result's rejection answered as the DO would have

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -49,7 +49,11 @@ import {
 import { envFromRequest } from "../../src/execution/sandboxEnv.js";
 import { IdleGuard, type IdleGuardHost } from "../../src/execution/sandboxIdle.js";
 import { StartGate, type StartGateHost, type StartingCause } from "../../src/execution/sandboxStart.js";
-import { RUNTIME_REPLACEMENT_WORDING, isRuntimeUnreachableSignal } from "../../src/execution/residentRefresh.js";
+import {
+  RUNTIME_REPLACEMENT_WORDING,
+  isRuntimeUnreachableSignal,
+  selfAndCauses,
+} from "../../src/execution/residentRefresh.js";
 import {
   fleetBusyAnswer,
   fleetBusyExecAnswer,
@@ -149,15 +153,6 @@ const RUNTIME_REPLACED_REASONS = new Set([
  *  closed (a runtime crash or stop), the socket failed, the upgrade failed. */
 const RPC_TRANSPORT_LOSS_KINDS = new Set(["peer_closed", "connection_failed", "upgrade_failed", "session_disposed"]);
 
-/** `err` and its `cause` chain, bounded like the SDK's own walk. */
-function* selfAndCauses(err: unknown): Generator<unknown> {
-  let link: unknown = err;
-  for (let depth = 0; link !== null && link !== undefined && depth < 8; depth++) {
-    yield link;
-    link = typeof link === "object" ? (link as { cause?: unknown }).cause : undefined;
-  }
-}
-
 /** Did the container's runtime change under the command? Typed first (the
  *  Durable Object sees the SDK's own classes, so `instanceof` holds here), the
  *  SDK's replacement wording second — the same list the resident Worker

package/dist/assets/deploy/secrets.manifest.json

@@ -16,6 +16,18 @@
       "workers": ["bot"],
       "note": "Anthropic Console key the bot runs on. Third-party."
     },
+    {
+      "name": "OPENAI_API_KEY",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "OpenAI key for the example config's `openai` provider block (`apiKeyEnv: OPENAI_API_KEY`). Third-party. Optional: read at the first model call on that block, never at load; without it every other block runs and only a run whose model names `openai/…` fails, by this name."
+    },
+    {
+      "name": "OPENROUTER_API_KEY",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "OpenRouter key for the example config's `openrouter` provider block (`apiKeyEnv: OPENROUTER_API_KEY`). Third-party. Optional: read at the first model call on that block, never at load; without it every other block runs and only a run whose model names `openrouter/…` fails, by this name."
+    },
     {
       "name": "ANTHROPIC_ADMIN_KEY",
       "workers": ["bot"],

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.244.0",
+  "version": "1.245.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.244.0",
+      "version": "1.245.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.244.0",
+      "version": "1.245.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.244.0",
+  "version": "1.245.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.244.0",
-  "commit": "de7fddf53659568639ad877e935a8b9c0177debd",
-  "builtAt": "2026-09-17T15:03:14.350Z"
+  "version": "1.245.0",
+  "commit": "5cc6e0f8a25dfb2406f9248a2245c7412e381da6",
+  "builtAt": "2026-09-17T19:32:54.666Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -145,7 +145,7 @@ export function statusCardRule(examples = '"Implement the fix", "Run the test su
 
 const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI. The body is a fixed-size MAP for the reader with everything for agents collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count — cut and resubmit. Prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. BEFORE authoring the pointers, load the \`pr-description\` skill with use_skill — it defines how to choose at most seven pointers, the mechanical anchor rules and what goes below the fold; follow it for every PR.
 EVERY PR includes one that already exists when you push — opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW — carry forward what the existing body says that is still true (a dependency bump's release notes belong in why), add what you changed, and anchor the pointers at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
-- **title**: the PR title — one line naming the change, specific enough to pick out of a PR list.
+- **title** (≤72 characters in all): the changelog line — \`type(scope): what a reader can now do or expect\`, one change, one clause, present tense. The type and the scope spend the same budget as the description, so the description is short; the body carries the rest. The tool refuses a longer title naming the count, and so does the gate in CI.
 - **TL;DR** (\`tldr\`, rendered first, ≤300): two sentences for a reader with zero context — what this PR does and why it matters.
 - **Why** (\`why\`, ≤400): the problem and the motivation, with the triggering issue/request, the record and the stack position hyperlinked. Why, never what: the diff shows what.
 - **Where to look** (\`pointers\`, 1 to 7): the files a reviewer would open first, in reading order, each { label ≤60, text ≤160, optional risk ≤100, anchor } with the anchor a { path, from, to } line range at your pushed head, rendered as a link (never embedded code). One pointer per idea, never per file; when the change has more ideas than seven, keep the seven whose mistake would cost most.
@@ -357,9 +357,9 @@ Your final message is posted to Slack — keep it readable, lead with the outcom
 
 // Both review prompts carry this verbatim. The findings contract
 // (docs/reference/specs/agent-ship.md item 6) lives here once — stable ids, the severity
-// vocabulary, the approve-over-blocking downgrade — so the sandbox and
-// resident variants can never drift apart on it.
-const REVIEW_VERDICT_INSTRUCTION = `VERDICT: before your final message, call the submit_verdict tool exactly once with \`approve\` (no blocking issues — nits alone are not blocking) or \`request_changes\`, a one-line summary, \`head\` = the output of \`git rev-parse HEAD\` in the checkout you reviewed, and \`findings\` — every issue you report as a structured entry with a stable id you assign in order (F1, F2, …), a severity of exactly blocking|major|minor|nit, the file (plus line when it points at one), and a one-line title. The findings array is the index of your review: the full explanation of each finding stays in your prose, keyed by the same ids. Switchboard writes the verdict as the first line of the GitHub comment itself and lists the findings under it; a review with no submitted verdict is posted as not approving, so never skip it. An \`approve\` carrying a blocking finding is downgraded to \`request_changes\` — approve only when nothing blocking remains. Do not write "LGTM" in your own text — the verdict line carries it.`;
+// vocabulary, the severity gate's downgrade (agent-review.md item 5a) — so the
+// sandbox and resident variants can never drift apart on it.
+const REVIEW_VERDICT_INSTRUCTION = `VERDICT: before your final message, call the submit_verdict tool exactly once with \`approve\` (no finding at or above the severity to address remains — the level in force for this run, \`minor\` by default: a major or a minor finding means \`request_changes\`; nits alone never block) or \`request_changes\`, a one-line summary, \`head\` = the output of \`git rev-parse HEAD\` in the checkout you reviewed, and \`findings\` — every issue you report as a structured entry with a stable id you assign in order (F1, F2, …), a severity of exactly blocking|major|minor|nit, the file (plus line when it points at one), and a one-line title. The findings array is the index of your review: the full explanation of each finding stays in your prose, keyed by the same ids. Switchboard writes the verdict as the first line of the GitHub comment itself and lists the findings under it; a review with no submitted verdict is posted as not approving, so never skip it. An \`approve\` carrying a finding at or above the severity to address is downgraded to \`request_changes\` and the tool's ack says so — approve only when every finding sits below the level. Do not write "LGTM" in your own text — the verdict line carries it.`;
 
 // The diff-gated spec review (docs/reference/specs/agent-review.md item 14) and
 // the test guard under it (item 16; specs-coverage.md item 6), one text for

package/dist/assets/src/config/profile.ts

@@ -231,7 +231,11 @@ export function boundedByParent(
  *  reply names. */
 export type ProfileRefusal =
   | { axis: "identity"; needs: Identity; cap: Identity; scope: BoundaryScope }
-  | { axis: "machine"; needs: MachineClass; allowed: MachineClass[]; scopes: BoundaryScope[] };
+  | { axis: "machine"; needs: MachineClass; allowed: MachineClass[]; scopes: BoundaryScope[] }
+  /** The minutes axis refuses only under a minimum the caller names (the
+   *  preset's lease minimum, `leaseMinimum` in `src/core/budgets.ts`): a lease
+   *  clipped below it would leave the loop no time at all. */
+  | { axis: "minutes"; needs: number; have: number; scope: BoundaryScope };
 
 /** The effective profile, or the refusal the authorize stage turns into a
  *  named reply. Resolution is pure; the gate judges. */
@@ -252,6 +256,8 @@ export function effectiveProfile(
   preset: Pick<AgentDef, "machine" | "identity" | "maxMinutes">,
   directives: { budget?: number },
   boundary: EffectiveBoundary | undefined,
+  /** The least lease the preset does anything under; absent, the minutes only clip. */
+  minimum?: number,
 ): ProfileResolution {
   if (boundary?.maxIdentity && !identityWithin(preset.identity, boundary.maxIdentity.value)) {
     return {
@@ -285,6 +291,16 @@ export function effectiveProfile(
     minutes = boundary.maxMinutes.value;
     boundedBy = boundary.maxMinutes.scope;
   }
+  // Under the minimum the clip is a refusal, not a run: the write-up and the
+  // post-step take the whole lease and the loop never turns. Attributed to
+  // whatever clipped; a declared ask under its own minimum is the module's
+  // invariant to catch, named as the defaults' here so the switch is total.
+  if (minimum !== undefined && minutes < minimum) {
+    return {
+      kind: "refused",
+      refusal: { axis: "minutes", needs: minimum, have: minutes, scope: boundedBy ?? "defaults" },
+    };
+  }
   return {
     kind: "profile",
     profile: {

package/dist/assets/src/core/authz/types.ts

@@ -66,6 +66,14 @@ export interface Actor {
    * → nothing: fail-closed, exactly today's behaviour.
    */
   readonly memberOf?: ReadonlySet<string>;
+  /**
+   * The person an admin's dashboard session is viewing as (record 0053): set
+   * beside `onBehalfOf` = that person's actor, so the effective grants are the
+   * intersection (the person's) and `self`/`memberOf` are the person's, while
+   * `id` stays the admin's. Identity for the audit line and the banner; the
+   * registry door refuses every non-read effect while it is set. No rule reads it.
+   */
+  readonly viewingAs?: { readonly id: string; readonly name?: string };
 }
 
 /** `<group>:<read|write|exec>` plus the non-command actions. A plain

package/dist/assets/src/core/budgets.ts

@@ -30,6 +30,19 @@ export const DAY_MS = 24 * 60 * MINUTE_MS;
  *  which stamps the expiry on its own clock. */
 export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
 
+/** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
+ *  resumed run's re-attach to its recorded worktree — waits for the resident
+ *  to wake when the Worker typed its refusal as the platform's transient
+ *  (docs/reference/specs/execution.md item 9): a Durable Object reset or lost
+ *  under the attach clears in seconds, so a minute is generous, and far under
+ *  the wake ceiling a mid-run re-attach may take — the card is silent while
+ *  this wait runs, then names it. It bounds the PROBING: past it no further
+ *  probe is made and, with nothing bound, a fresh run falls cold and a resumed
+ *  run is refused, the wait named either way; a re-attach already opened
+ *  inside it runs to the attach's own timeout. The run's own stop ends any of
+ *  it at once. Read by the executor factory. */
+export const FIRST_ATTACH_WAIT_MS = MINUTE_MS;
+
 /** The presets that run the tool loop, and the one pipeline preset. */
 export const LOOP_PRESETS = ["general", "coding", "review", "research", "explore", "conductor"] as const;
 export type LoopPreset = (typeof LOOP_PRESETS)[number];
@@ -127,6 +140,18 @@ export function postStepLease(preset: string, remainingMs: number | undefined):
   return Math.min(allowance, Math.max(1, remainingMs / MINUTE_MS));
 }
 
+/** The least lease under which a loop-running preset does anything: the
+ *  write-up and the preset's post-step are held back from every lease
+ *  (`loopClock`), so a lease of that sum leaves the loop nothing — the run
+ *  goes straight to its write-up and reports a budget it never had. One minute
+ *  above the sum is the least that runs a turn. A profile clipped under this by
+ *  a directive, a boundary or a parent's remainder is refused at the gate
+ *  naming it, the way a ship round is refused under its floor; the floors are
+ *  the larger numbers a round needs to be worth dispatching. */
+export function leaseMinimum(preset: string): number {
+  return ALLOWANCES.writeUp + postStepMinutes(preset) + 1;
+}
+
 /** A follow-up turn's lease, in ms: the lesser of what it asks and what the
  *  run's lease still holds, never under a minute — the grace covers that floor
  *  when the turn starts by the lease's end; later, the bearer may expire under