@coreplane/switchboard 1.246.0 → 1.248.0

package/dist/assets/config/config.example.yaml

@@ -347,7 +347,7 @@ workspaceDir: ./workspaces
 # `ship` fails the load by name.
 # ship:
 #   maxRounds: 3      # review rounds per unit
-#   maxMinutes: 120   # the ship preset's wall-clock budget in minutes (the registry's default)
+#   maxMinutes: 240   # the ship preset's wall-clock budget in minutes (the registry's default)
 
 # Which harness each preset's runs are driven by, deployment-wide
 # (docs/reference/specs/harness.md item 8): a mapping of preset to a harness's

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -641,8 +641,18 @@ interface ConfirmationRow extends ConfirmationInput {
 }
 /** Why a consume or a cancel refused: the row is gone (`used`), past its expiry (`expired`), or someone else's (`foreign`). */
 type ConfirmationRefusal = "used" | "expired" | "foreign";
-type ConfirmationOutcome = { row: ConfirmationRow } | { refused: ConfirmationRefusal };
+/** A refusal names the row where one still exists — `expired` (deleted here)
+ *  and `foreign` (kept) — so the bot can record the click's refusal against
+ *  the command that was bound (record 0054); `used` has no row to name. */
+type ConfirmationOutcome = { row: ConfirmationRow } | { refused: ConfirmationRefusal; row?: ConfirmationRow };
 type ConfirmationCancelOutcome = { ok: true } | { refused: Exclude<ConfirmationRefusal, "expired"> };
+/** The consume log's word: a refusal may carry the row it names (expired,
+ *  foreign), so the refusal is the discriminant, never the row's presence. The
+ *  parameter is the declared union, where the narrowing holds; the stub's
+ *  return type narrows to `never` across `in`. */
+function consumeWord(outcome: ConfirmationOutcome): string {
+  return "refused" in outcome ? outcome.refused : "consumed";
+}
 
 function isJsonObject(v: unknown): v is Record<string, unknown> {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -718,9 +728,9 @@ export class ConfigDO extends DurableObject<Env> {
       if (!stored) return { refused: "used" };
       if (stored.expiresAt <= now) {
         this.sql.exec(`DELETE FROM confirmations WHERE id = ?`, id);
-        return { refused: "expired" };
+        return { refused: "expired", row: stored };
       }
-      if (!actorIds.includes(stored.requester)) return { refused: "foreign" };
+      if (!actorIds.includes(stored.requester)) return { refused: "foreign", row: stored };
       this.sql.exec(`DELETE FROM confirmations WHERE id = ?`, id);
       return { row: stored };
     });
@@ -1233,7 +1243,7 @@ async function handleConfig(pathname: string, body: unknown, env: Env): Promise<
       const click = confirmationClickOf(b);
       if (click instanceof Response) return click;
       const outcome = await dO.consumeConfirmation(click.id, click.actorIds, systemClock());
-      console.log(`[config/confirmations/consume] ${click.id} ${"row" in outcome ? "consumed" : outcome.refused}`);
+      console.log(`[config/confirmations/consume] ${click.id} ${consumeWord(outcome)}`);
       return json(outcome);
     }
     case "/config/confirmations/cancel": {

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -628,7 +628,7 @@ const ATTACH_MUTEX_WAIT_MS = 60_000;
  *  20-minute ceiling (`BASH_TIMEOUT_MAX_MS`) — clamped server-side by
  *  `clampBashTimeout` in handleExec, never trusting the client's number. The
  *  heartbeat keeps every HTTP hop alive for the whole budget; the ceiling
- *  stays far inside the bot's 45-min run budget. Work beyond 20 minutes
+ *  stays far inside the bot's 90-min coding budget. Work beyond 20 minutes
  *  belongs in background jobs.
  *
  *  /op runs (test/build) get the flat 20-minute ceiling — the deterministic op

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.246.0",
+  "version": "1.248.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.246.0",
+      "version": "1.248.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.246.0",
+      "version": "1.248.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.246.0",
+  "version": "1.248.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -39,14 +39,16 @@
     "cli": "tsx src/cli.ts",
     "verify": "npm run verify:root && npm run verify --workspaces --if-present && npm run check:site",
     "verify:root": "npm run check:consistency && npm run typecheck && npm run lint && npm run format:check && npm test && npm run check:dist",
-    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run licenses:check && npm run docs:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run agents:check && npm run clock:check && npm run screenshots:check",
+    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run agents:check && npm run clock:check && npm run screenshots:check",
     "ci:gate": "node scripts/ci-gate.mjs",
-    "fix": "npm run docs:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
+    "fix": "npm run docs:gen && npm run pr-title:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
     "deploy:gen": "npm run --silent cli -- deploy init",
     "deploy:check": "npm run --silent cli -- deploy init --check",
     "check:lockfile": "node scripts/check-lockfile.mjs",
     "check:sandbox-pair": "node scripts/check-sandbox-pair.mjs",
     "check:pr-title": "node scripts/check-pr-title.mjs",
+    "pr-title:gen": "node scripts/pr-title-vocabulary.mjs --write",
+    "pr-title:check": "node scripts/pr-title-vocabulary.mjs",
     "check:project-facts": "node scripts/check-project-facts.mjs",
     "agents:gen": "tsx scripts/agents-gen.ts",
     "clock:gen": "tsx scripts/clock-allowlist.mts --write",

package/dist/assets/project.json

@@ -100,8 +100,16 @@
       "when": "After bumping either half of a pair."
     },
     "check:pr-title": {
-      "does": "Judges one PR title as the changelog line it becomes: grammar, type, scope, the migration note behind `!`.",
-      "when": "`-- \"feat(scope): …\"` before opening a PR; CI's `title` check runs it."
+      "does": "Judges one PR title as the changelog line: grammar, type, scope, the `!` migration note.",
+      "when": "`-- \"feat(scope): …\"` before opening a PR; CI's `title` check."
+    },
+    "pr-title:gen": {
+      "does": "Writes the title gate's types and scopes from the release config and the code map.",
+      "when": "Part of `fix`."
+    },
+    "pr-title:check": {
+      "does": "The committed title vocabulary equals its two sources.",
+      "when": "Part of `check:consistency`."
     },
     "check:dist": {
       "does": "Builds, then proves the compiled entry points and the web bundle the image needs exist.",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.246.0",
-  "commit": "62e4e9ad464820900b07bed176e140af6682c598",
-  "builtAt": "2026-09-18T01:06:13.947Z"
+  "version": "1.248.0",
+  "commit": "e2ba9e4c1b52ac15c841be8ad086b017d4a14ced",
+  "builtAt": "2026-09-18T04:34:16.576Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -2,7 +2,12 @@
 import type { Effort } from "../effort.js";
 import { BASH_TIMEOUT_MAX_MS } from "../execution/bashTimeout.js";
 import { ASKS, RUNAWAY_TURNS_PER_MINUTE, runawayTurnCap, type LoopPreset } from "../core/budgets.js";
-import { CONTRACT_HEADING, CONTRACT_SECTION_HEADINGS, PR_TITLE_GUARD } from "../core/ship/contract.js";
+import {
+  CONTRACT_HEADING,
+  CONTRACT_SECTION_HEADINGS,
+  PR_TITLE_GUARD,
+  TIMEOUT_ON_LONG_COMMANDS,
+} from "../core/ship/contract.js";
 // Which model runs it is resolved separately by the config layers, so any
 // agent can run on any configured provider/model.
 
@@ -143,7 +148,7 @@ export function statusCardRule(examples = '"Implement the fix", "Run the test su
   );
 }
 
-const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI. The body is a fixed-size MAP for the reader with everything for agents collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count — cut and resubmit. Prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. BEFORE authoring the pointers, load the \`pr-description\` skill with use_skill — it defines how to choose at most seven pointers, the mechanical anchor rules and what goes below the fold; follow it for every PR.
+const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI, and on Switchboard's own repository the tool refuses the same titles with the gate's own sentence, so fix the title and resubmit rather than pushing on. The body is a fixed-size MAP for the reader with everything for agents collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count — cut and resubmit. Prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. BEFORE authoring the pointers, load the \`pr-description\` skill with use_skill — it defines how to choose at most seven pointers, the mechanical anchor rules and what goes below the fold; follow it for every PR.
 EVERY PR includes one that already exists when you push — opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW — carry forward what the existing body says that is still true (a dependency bump's release notes belong in why), add what you changed, and anchor the pointers at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
 - **title** (≤72 characters in all): the changelog line — \`type(scope): what a reader can now do or expect\`, one change, one clause, present tense. The type and the scope spend the same budget as the description, so the description is short; the body carries the rest. The tool refuses a longer title naming the count, and so does the gate in CI.
 - **TL;DR** (\`tldr\`, rendered first, ≤300): two sentences for a reader with zero context — what this PR does and why it matters.
@@ -233,7 +238,7 @@ Keep notes with the \`notes\` tool: one short document, replaced whole each time
 // project's most expensive checks first; the rule is the runner's to hold, not
 // a line every requester remembers to paste. Stack-agnostic on purpose — the
 // classes are by duration, the project's own scripts and CI say which is which.
-export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
+export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS} The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
 
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 

package/dist/assets/src/core/budgets.ts

@@ -68,12 +68,18 @@ export type Preset = LoopPreset | "ship";
 
 /** What each preset asks for when nothing above it is tighter, in minutes. The
  *  pipeline's (`ship`) is the wall clock one segment of its loop runs under;
- *  a deployment's `ship.maxMinutes` replaces it, held to `fit` below. */
+ *  a deployment's `ship.maxMinutes` replaces it, held to `fit` below. Coding's
+ *  is sized by the ledger's ship children, not its standalone runs: a child
+ *  that pushes at minute 29 and then runs the repo's whole gate (seven to ten
+ *  minutes on a resident) was cut at 45 one run in twelve, so the ask is
+ *  double the 90th percentile (31.5) with the gate inside it. Ship's holds
+ *  its own loop at the default rounds with a fix round at that ask, not at
+ *  its floor (`fit` proves the floor case; the ask leaves room above it). */
 export const ASKS: Readonly<Record<Preset, number>> = {
   general: 5,
-  coding: 45,
+  coding: 90,
   review: 25,
-  ship: 120,
+  ship: 240,
   research: 8,
   explore: 120,
   conductor: 120,
@@ -87,10 +93,13 @@ export type RoundKind = "coding" | "review" | "fix" | "merge";
  *  falls under the floor is refused rather than dispatched: a two-minute
  *  review or fix costs an attach and a model turn and finishes nothing.
  *  Review's is the ledger's 90th percentile of completed reviews (5.1 min over
- *  181); coding's and the merge wait's are guesses until the ledger says. */
+ *  181); coding's is the least a fix round can run the repo's gate in — the
+ *  gate alone takes seven to ten minutes on a resident, and a fix that cannot
+ *  run it finishes nothing its contract asks; the merge wait's is a guess
+ *  until the ledger says. */
 export const PRESET_FLOORS: Readonly<Record<LoopPreset, number>> = {
   general: 2,
-  coding: 10,
+  coding: 15,
   review: 5,
   research: 3,
   explore: 15,
@@ -387,6 +396,9 @@ export type GrantSource = "org" | "channel" | "user" | "run";
 export const DEFAULT_GRANT: Grant = { renewals: 0 };
 
 /** The most renewals one request may carry: thirteen segments of the ship
- *  preset's ask are a day, the longest problem a person hands over in one
- *  message before a plan should carry it. */
+ *  preset's ask are two days. The cap bounds a COUNT a person types
+ *  (`renewals:`) or a scope holds; it did not halve when the ask doubled,
+ *  since every grant already configured is a count of segments and a day's
+ *  hand-over is now `renewals: 5` — the longest problem a person hands over
+ *  in one message before a plan should carry it. */
 export const GRANT_RENEWALS_MAX = 12;

package/dist/assets/src/core/runEvents.ts

@@ -462,7 +462,7 @@ export type RouteInputValue = RouteInputLeafOrList | RouteInputObject3;
  *  `pasted` — the typed line that followed a hand-back in its thread, with the
  *  same receipt, ran. A routed read carries no outcome: it is not a decision
  *  about a state change. */
-export type RouteOutcome = "hand_back" | "offered" | "confirmed" | "pasted";
+export type RouteOutcome = "hand_back" | "offered" | "confirmed" | "pasted" | "refused";
 
 export type RunEvent =
   /** `callId` is the provider's tool_use id — the explicit pair key between a
@@ -864,6 +864,10 @@ export type RunEvent =
       input?: { readonly [key: string]: RouteInputValue };
       receipt?: string;
       outcome?: RouteOutcome;
+      /** The refusal's code (src/core/refusal.ts) when `outcome` is `refused`
+       *  (record 0054): a refusal after a command was bound is a run
+       *  record, and the door report counts it by cause and code. */
+      refusalCode?: string;
       handBackRunId?: string;
       seq?: number;
       at?: number;

package/dist/assets/src/core/ship/contract.ts

@@ -129,6 +129,13 @@ export const CONTRACT_SECTION_HEADINGS = {
  *  repository's rules file (~15k characters) and a long unit both inside it. */
 export const DEFAULT_CONTRACT_MAX_CHARS = 48_000;
 
+/** The most of a plan a reader hands the parsers: ten times the tool clip
+ *  (`MAX_FILE_CHARS`, `src/execution/githubApi.ts`), which a plan that grows by
+ *  amendment passes — the program plan crossed 400k characters and the seed
+ *  then saw its first 25 units alone. A plan past this bound is refused by
+ *  name, never parsed short. */
+export const PLAN_MAX_CHARS = 2_000_000;
+
 const UNIT_HEADING = /^### (U\d+)\. (.+?)\s*$/;
 const ANY_HEADING = /^#{2,3} /;
 const BULLET = /^- \*\*([^*]+)\*\*:(?:\s?(.*))?$/;
@@ -422,6 +429,16 @@ function hasApproach(unit: ContractUnit): boolean {
   return "Approach" in unit.bullets;
 }
 
+/** The timeout clause every coding contract carries after the wind-down
+ *  sentence (agent-coding item 13; harness-pi items 7 and 15): the harness
+ *  refuses a bash call whose explicit timeout reaches past the loop's end
+ *  before it runs, so a stated timeout is what turns a command that could
+ *  never finish into a refusal the model reads at once, instead of minutes
+ *  spent on it and a cut at the end. One sentence, stack-agnostic. */
+export const TIMEOUT_ON_LONG_COMMANDS =
+  "State a timeout on any command you expect to run longer than a minute: a timeout that reaches past the loop's " +
+  "end is refused before the command runs, never cut midway.";
+
 function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
   const branch = rebase.branch ? `\`${rebase.branch}\`` : "the unit's branch";
   const onto = rebase.onto ? `\`${rebase.onto}\`` : "the merged parent";
@@ -432,7 +449,7 @@ function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
     `full verification, which runs after that push with any fix as a further commit; an unpushed tree does not ` +
     `survive the run's end. Right before each push, fetch ${onto} again and rebase once more if it moved while ` +
     `you worked, so the pull request is not born conflicting. At the wind-down note, commit and push what compiles, ` +
-    `say what does not, then answer.`
+    `say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS}`
   );
 }
 

package/dist/assets/src/core/ship/coordinator.ts

@@ -754,7 +754,7 @@ export const WAIT_MARGIN_MS = SHIP_WAIT.marginMinutes * MIN;
  *  one chunk of the runner's time, not the child's whole budget. Five minutes
  *  is the machine's one cadence for asking the bot what it cannot be told (the
  *  margin and the merge poll are the same number), and it keeps a round to a
- *  few steps: a coding child's 45 minutes are ten waits and ten reads. */
+ *  few steps: a coding child's 90 minutes are eighteen waits and eighteen reads. */
 export const WAIT_CHUNK_MS = SHIP_WAIT.chunkMinutes * MIN;
 /** The merge wait is a round of its own: its minutes are carved from the
  *  pipeline's remainder when the door is first asked (the merge wait's ask and

package/dist/assets/src/core/trace/attrs.ts

@@ -26,6 +26,11 @@ export interface AttrDomain {
   requester: "message" | "relay-footer" | "thread-parent" | "bot";
   // dispatch.* / run.* / post.*
   outcome: string;
+  /** The refusal's code (src/core/refusal.ts) — on the `dispatch.refuse` span
+   *  and the request's root, so refusals are countable from the trace alone. */
+  refusal: string;
+  /** The refusal's cause, from the one code→cause table in src/core/refusal.ts. */
+  cause: "request" | "policy" | "system";
   count: number;
   backend: Backend;
   // run.command
@@ -114,6 +119,8 @@ export type SpanAttrs = { readonly [K in SpanAttrKey]?: AttrDomain[K] };
 const IDENTIFIER_KEYS: ReadonlySet<SpanAttrKey> = new Set<SpanAttrKey>([
   "runId",
   "outcome",
+  "refusal",
+  "cause",
   "command",
   "route",
   "host",
@@ -163,6 +170,8 @@ const ATTR_TYPE: Record<SpanAttrKey, "string" | "number" | "boolean"> = {
   dedupe: "string",
   requester: "string",
   outcome: "string",
+  refusal: "string",
+  cause: "string",
   count: "number",
   backend: "string",
   command: "string",