@dzhechkov/harness-core 0.8.47 → 0.8.48

package/src/stage-usage.ts

@@ -54,6 +54,199 @@ function price(row: RecordRow, dimensions: Record<typeof tokenFields[number], nu
       capturedAt: text(prices?.['snapshotAt']), fingerprint: fnv1a64(JSON.stringify(prices ?? MODEL_PRICES)), current: false, billed: false } };
 }
 
+type RoutingInput = Parameters<typeof buildStageUsageReport>[0];
+type RoutingAttempt = { ordinal: number; model: string | null; family: 'openai' | 'claude'; wrapperInvoked: boolean;
+  outcome: 'answered' | 'failed' | 'rejected'; reason: string; selected: boolean };
+type RoutingStage = { evidenceKey: string; dispatchSeq: number; plannedModel: string | null;
+  plannedModelSource: 'plan-declared' | 'plan-omitted' | 'unavailable' | 'not-recorded'; requestedModel: string | null;
+  probeId: string | null; linkStatus: string };
+type RoutingProbe = { probeId: string; runId: string; family: 'openai' | 'claude'; source: string;
+  selectedModel: string | null; complete: boolean; totalConsidered: number; attempts: RoutingAttempt[] };
+const safeRoutingModel = (value: unknown): value is string => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(value);
+const routingId = (value: unknown): value is string => typeof value === 'string' && /^[0-9a-f]{32}$/.test(value);
+const routingRun = (value: unknown): value is string => typeof value === 'string' && /^[A-Za-z0-9_.-]{1,128}$/.test(value) && value !== '.' && value !== '..';
+const routingFamily = (value: unknown): value is 'openai' | 'claude' => value === 'openai' || value === 'claude';
+const exactRoutingKeys = (value: unknown, keys: readonly string[]): value is RecordRow => record(value)
+  && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)
+  && Reflect.ownKeys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+const routingAbsenceReasons = ['producer-not-recorded', 'id-factory-missing'];
+const routingErrorReasons = ['id-factory-invalid', 'provenance-invalid', 'candidate-model-invalid', 'wrapper-result-invalid', 'selected-model-invalid'];
+
+function validateRoutingAttempts(value: unknown, family: unknown, selectedModel: unknown): { complete: boolean; totalConsidered: number; attempts: RoutingAttempt[] } | null {
+  if (!exactRoutingKeys(value, ['schema', 'complete', 'totalConsidered', 'attempts']) || value['schema'] !== 'wf-probe-attempts-1'
+    || typeof value['complete'] !== 'boolean' || !routingFamily(family) || (selectedModel !== null && !safeRoutingModel(selectedModel))) return null;
+  const total = count(value['totalConsidered']);
+  const attempts = value['attempts'];
+  if (total === null || total === 0 || !Array.isArray(attempts) || attempts.length !== Math.min(total, 32) || value['complete'] !== (total <= 32)) return null;
+  const safe: RoutingAttempt[] = [];
+  for (const [index, a] of attempts.entries()) {
+    if (!exactRoutingKeys(a, ['ordinal', 'model', 'family', 'wrapperInvoked', 'outcome', 'reason', 'selected']) || a['ordinal'] !== index + 1
+      || a['family'] !== family || typeof a['wrapperInvoked'] !== 'boolean' || typeof a['selected'] !== 'boolean') return null;
+    const rejected = family === 'claude' && !a['wrapperInvoked'] && !a['selected'] && a['model'] === null && a['outcome'] === 'rejected' && a['reason'] === 'invalid-candidate';
+    const answered = a['wrapperInvoked'] && a['selected'] && safeRoutingModel(a['model']) && a['outcome'] === 'answered' && a['reason'] === 'answered';
+    const failed = a['wrapperInvoked'] && !a['selected'] && safeRoutingModel(a['model']) && a['outcome'] === 'failed'
+      && ['timeout', 'spawn-error', 'no-exit-code', 'exit-nonzero', 'unexpected-response'].includes(a['reason'] as string);
+    if (!(rejected || answered || failed)) return null;
+    safe.push({ ordinal: index + 1, model: a['model'] as string | null, family, wrapperInvoked: a['wrapperInvoked'],
+      outcome: a['outcome'] as RoutingAttempt['outcome'], reason: a['reason'] as string, selected: a['selected'] });
+  }
+  const selected = safe.filter(a => a.selected);
+  if (!value['complete'] ? selected.length !== 0 : selectedModel === null ? selected.length !== 0
+    : selected.length !== 1 || selected[0]?.ordinal !== total || selected[0]?.model !== selectedModel) return null;
+  return { complete: value['complete'], totalConsidered: total, attempts: safe };
+}
+
+function routingStageIdentity(row: RecordRow): { evidenceKey: string; dispatchSeq: number } | null {
+  const seq = count(row['dispatchSeq']);
+  if (seq === null || seq === 0 || !routingRun(row['runId'])) return null;
+  const evidenceKey = JSON.stringify(['wf-dispatch', row['runId'], seq]);
+  if (Object.hasOwn(row, 'evidenceKey') && row['evidenceKey'] !== evidenceKey) return null;
+  return { evidenceKey, dispatchSeq: seq };
+}
+
+/** Routing uses raw bounded evidence, independently of numerical first-wins normalization. */
+function projectRoutingProvenance(input: RoutingInput) {
+  const diagnostics = new Set<string>();
+  let defect = false;
+  let partial = false;
+  let scopeInvalid = false;
+  let scopeIncomplete = false;
+  const mark = (reason: string, severity: 'defect' | 'partial' = 'partial') => {
+    diagnostics.add(reason);
+    if (severity === 'defect') defect = true; else partial = true;
+  };
+  const metadataInvalid = (reason = 'metadata-invalid') => mark(reason, 'defect');
+  const sourceMap: Record<string, [string, 'defect' | 'partial']> = {
+    'inventory-truncated': ['source-truncated', 'partial'], 'source-input-too-large': ['source-too-large', 'partial'],
+    'missing-or-unreadable-source': ['source-unreadable', 'partial'], 'malformed-record': ['source-malformed', 'defect'],
+    'malformed-budget-schema': ['source-malformed', 'defect'],
+    'inventory-run-state-unavailable-or-foreign': ['source-scope-incomplete', 'partial'],
+    'inventory-trace-binding-unavailable': ['source-scope-incomplete', 'partial'],
+  };
+  const invalidSources = ['source-outside-root-or-nonregular', 'source-symlink', 'source-changed-during-read',
+    'inventory-trace-binding-mismatch', 'inventory-trace-invalid', 'inventory-workflow-projection-identity-invalid',
+    'inventory-workflow-projection-identity-mismatch', 'foreign-project-root', 'foreign-trace-run', 'unknown-source',
+    'source-selection-ambiguous', 'source-selection-conflicting-run-dir', 'workflow-source-missing-or-ambiguous', 'fa-run-selection-ambiguous-or-unidentified'];
+  for (const diagnostic of input.diagnostics ?? []) {
+    if (typeof diagnostic !== 'string' || diagnostic.length === 0) continue;
+    const name = diagnostic.split(':', 1)[0]!;
+    const mapping = invalidSources.includes(name) ? ['source-scope-invalid', 'defect'] as const : sourceMap[name];
+    if (mapping) { mark(mapping[0], mapping[1]); scopeInvalid ||= mapping[0] === 'source-scope-invalid'; scopeIncomplete ||= mapping[1] === 'partial'; }
+    else { mark('source-diagnostic-unmapped'); scopeIncomplete = true; }
+  }
+  const maximum = input.maxRecords ?? 100000;
+  if (input.rows.length > maximum || (input.expected?.length ?? 0) > maximum) { mark('source-truncated'); scopeIncomplete = true; }
+  const rawRows = input.rows.slice(0, maximum);
+  const invalidNormalizedKeys = new Set<string>();
+  const stageMaps = new Map<string, { raw: RecordRow; tuple: string; conflict: boolean; legacy: boolean; valid: boolean; modelInvalid: boolean }>();
+  const probeMaps = new Map<string, { raw: RecordRow; tuple: string; conflict: boolean; valid: boolean; reason: string | null; summary: RoutingProbe | null }>();
+  let hasNew = false;
+  let hasLegacy = false;
+  if (input.sourceKind === 'workflow-budget') {
+    if (!routingRun(input.runId)) { mark('source-scope-invalid', 'defect'); scopeInvalid = true; }
+    if (input.expected === undefined) { mark('source-scope-incomplete'); scopeIncomplete = true; }
+    for (const raw of rawRows) {
+      if (raw['kind'] === 'probe') {
+        const keys = ['probeId', 'probeProvenance', 'probeSource', 'probeObservationReason'];
+        const present = keys.map(key => Object.hasOwn(raw, key));
+        if (present.every(value => !value)) { hasLegacy ||= raw['runId'] === input.runId; continue; }
+        hasNew ||= raw['runId'] === input.runId;
+        const reason = raw['probeObservationReason'];
+        const modelValid = raw['model'] === null || safeRoutingModel(raw['model']);
+        const reasonValid = reason === null || (typeof reason === 'string' && [...routingAbsenceReasons, ...routingErrorReasons].includes(reason));
+        const idValid = raw['probeId'] === null || routingId(raw['probeId']);
+        const sourceValid = raw['probeSource'] === 'dispatcher-child-seam' || raw['probeSource'] === 'scripted-dispatcher';
+        const provenance = reason === null ? validateRoutingAttempts(raw['probeProvenance'], raw['family'], raw['model']) : null;
+        const valid = present.every(Boolean) && routingRun(raw['runId']) && routingFamily(raw['family']) && idValid && sourceValid && modelValid && reasonValid
+          && (reason === null ? routingId(raw['probeId']) && provenance !== null : raw['probeProvenance'] === null);
+        const supplied = raw['probeProvenance'];
+        const unsafeAttemptModel = record(supplied) && Array.isArray(supplied['attempts']) && supplied['attempts'].slice(0, 32).some(a => record(a)
+          && Object.hasOwn(a, 'model') && a['model'] !== null && !safeRoutingModel(a['model']));
+        if (!valid) metadataInvalid(modelValid && !unsafeAttemptModel ? 'metadata-invalid' : 'model-invalid');
+        else if (typeof reason === 'string') mark(reason, routingErrorReasons.includes(reason) ? 'defect' : 'partial');
+        else if (provenance && !provenance.complete) mark('attempts-truncated');
+        if (!routingId(raw['probeId'])) continue;
+        const summary: RoutingProbe | null = valid && reason === null && provenance !== null ? {
+          probeId: raw['probeId'], runId: raw['runId'] as string, family: raw['family'] as RoutingProbe['family'], source: raw['probeSource'] as string,
+          selectedModel: raw['model'] as string | null, complete: provenance.complete, totalConsidered: provenance.totalConsidered, attempts: provenance.attempts,
+        } : null;
+        // Rejected metadata is one closed marker: never traverse, copy or stringify its raw payload.
+        const tuple = JSON.stringify(valid
+          ? ['valid', raw['runId'], raw['family'], raw['model'], raw['probeSource'], reason, provenance]
+          : ['invalid']);
+        const old = probeMaps.get(raw['probeId']);
+        if (old && old.tuple !== tuple) { old.conflict = true; metadataInvalid('identity-conflict'); }
+        else if (!old) probeMaps.set(raw['probeId'], { raw, tuple, conflict: false, valid, reason: typeof reason === 'string' ? reason : null, summary });
+      } else if (raw['kind'] === 'stage') {
+        const identity = routingStageIdentity(raw);
+        if (!identity || raw['runId'] !== input.runId) {
+          metadataInvalid();
+          const key = text(raw['evidenceKey']) ?? (count(raw['dispatchSeq']) !== null ? JSON.stringify(['wf-dispatch', raw['runId'], raw['dispatchSeq']]) : null);
+          if (key !== null) invalidNormalizedKeys.add(key);
+          continue;
+        }
+        const keys = ['plannedModel', 'plannedModelSource', 'probeId'];
+        const present = keys.map(key => Object.hasOwn(raw, key));
+        const legacy = present.every(value => !value);
+        hasLegacy ||= legacy; hasNew ||= !legacy;
+        const plan = raw['plannedModel'];
+        const source = raw['plannedModelSource'];
+        const requestValid = raw['requestedModel'] === null || safeRoutingModel(raw['requestedModel']);
+        const planValid = source === 'plan-declared' ? safeRoutingModel(plan) : (source === 'plan-omitted' || source === 'unavailable') && plan === null;
+        const valid = legacy || present.every(Boolean) && requestValid && planValid && routingFamily(raw['family']) && (raw['probeId'] === null || routingId(raw['probeId']));
+        const modelInvalid = !legacy && (!requestValid || (source === 'plan-declared' && !safeRoutingModel(plan)) || source === 'unavailable');
+        if (!valid || modelInvalid) metadataInvalid(modelInvalid ? 'model-invalid' : 'metadata-invalid');
+        const tuple = JSON.stringify(legacy
+          ? ['legacy', routingFamily(raw['family']) ? raw['family'] : null, safeRoutingModel(raw['requestedModel']) ? raw['requestedModel'] : null]
+          : valid ? ['valid', raw['family'], raw['requestedModel'], plan, source, raw['probeId']] : ['invalid']);
+        const old = stageMaps.get(identity.evidenceKey);
+        if (old && old.tuple !== tuple) { old.conflict = true; metadataInvalid('identity-conflict'); }
+        else if (!old) stageMaps.set(identity.evidenceKey, { raw, tuple, conflict: false, legacy, valid, modelInvalid });
+      } else metadataInvalid();
+    }
+    for (const expected of (input.expected ?? []).slice(0, maximum)) {
+      const identity = routingStageIdentity(expected);
+      if (!identity || expected['runId'] !== input.runId) { metadataInvalid(); continue; }
+      if (!stageMaps.has(identity.evidenceKey)) { mark('expected-dispatch-missing'); scopeIncomplete = true; }
+    }
+  }
+  if (hasNew && hasLegacy) mark('not-recorded');
+  const stages: RoutingStage[] = [];
+  for (const [evidenceKey, stage] of [...stageMaps].sort(([a], [b]) => a.localeCompare(b))) {
+    const raw = stage.raw;
+    const referenced = routingId(raw['probeId']) ? probeMaps.get(raw['probeId']) : undefined;
+    let linkStatus = 'linked';
+    if (stage.conflict || referenced?.conflict) linkStatus = 'identity-conflict';
+    else if (scopeInvalid || !stage.valid || stage.modelInvalid || referenced && (!referenced.valid || referenced.reason !== null && routingErrorReasons.includes(referenced.reason))) linkStatus = 'invalid';
+    else if (stage.legacy) linkStatus = 'not-recorded';
+    else if (referenced && referenced.raw['runId'] !== input.runId) linkStatus = 'foreign-probe';
+    else if (referenced && referenced.raw['family'] !== raw['family']) linkStatus = 'family-mismatch';
+    else if (referenced?.summary && (referenced.summary.selectedModel === null || referenced.summary.selectedModel !== raw['requestedModel'])) linkStatus = 'selection-mismatch';
+    else if (raw['probeId'] !== null && !referenced) linkStatus = 'missing-probe';
+    else if (raw['probeId'] === null || referenced?.reason !== null && referenced?.reason !== undefined) linkStatus = 'probe-unavailable';
+    else if (scopeIncomplete) linkStatus = 'scope-incomplete';
+    const suppress = ['identity-conflict', 'invalid', 'foreign-probe', 'family-mismatch', 'selection-mismatch'].includes(linkStatus);
+    if (suppress) metadataInvalid(linkStatus === 'invalid' ? 'metadata-invalid' : linkStatus);
+    else if (linkStatus !== 'linked' && linkStatus !== 'not-recorded') mark(linkStatus === 'scope-incomplete' ? 'source-scope-incomplete' : linkStatus);
+    const identity = routingStageIdentity(raw)!;
+    stages.push({ evidenceKey, dispatchSeq: identity.dispatchSeq, plannedModel: suppress || stage.legacy ? null : raw['plannedModel'] as string | null,
+      plannedModelSource: suppress ? 'unavailable' : stage.legacy ? 'not-recorded' : raw['plannedModelSource'] as RoutingStage['plannedModelSource'],
+      requestedModel: suppress || stage.legacy ? null : raw['requestedModel'] as string | null,
+      probeId: !suppress && (linkStatus === 'linked' || linkStatus === 'scope-incomplete') ? raw['probeId'] as string : null, linkStatus });
+  }
+  const probes = [...probeMaps.values()].filter(probe => !scopeInvalid && !probe.conflict && probe.summary && probe.raw['runId'] === input.runId)
+    .map(probe => probe.summary!).sort((a, b) => a.probeId.localeCompare(b.probeId));
+  if (!hasNew) diagnostics.add('not-recorded');
+  const status = defect ? 'defect' : partial ? 'partial' : hasNew ? 'observed' : 'not-recorded';
+  const exposedStages = hasNew || defect ? stages : [];
+  const stageFields = new Map(stages.map(stage => [stage.evidenceKey, {
+    plannedModel: stage.plannedModel, plannedModelSource: stage.plannedModelSource, probeId: stage.probeId,
+  }]));
+  for (const key of invalidNormalizedKeys) stageFields.set(key, { plannedModel: null, plannedModelSource: 'unavailable', probeId: null });
+  return { report: { schema: 'routing-provenance-1', status, probes: probes.length ? probes : null,
+    stages: exposedStages.length ? exposedStages : null, diagnostics: [...diagnostics].sort() }, stageFields };
+}
+
 /** All amounts remain source-specific; inventory never substitutes for a numeric witness. */
 export function buildStageUsageReport(input: {
   sourceKind: string; sourcePath: string; runId: string | null; rows: readonly RecordRow[];
@@ -173,8 +366,9 @@ export function buildStageUsageReport(input: {
   const pricingComplete = rows.length > 0 && rows.every((r) => r.pricingKnown) && totalComplete;
   const conservation = { status: quantitativeDefect ? 'DEFECT' : totalComplete ? 'BALANCED' : 'INSUFFICIENT_DATA', scope: 'reported receipt attribution; not independent source verification', metric };
   const dimensionCoverage = Object.fromEntries(tokenFields.map((key) => [key, { known: rows.filter((r) => r[key] !== null).length, unknown: rows.filter((r) => r[key] === null).length + expectedMissing.length }]));
-  return { schema: 'stage-usage-1', sourceKind: input.sourceKind, sourcePath: input.sourcePath, runId: input.runId, metric: compatible ? metric : 'incompatible-metrics',
-    rows, verdict: conservation.status, complete: totalComplete && witnessComplete && pricingComplete,
+  const routing = projectRoutingProvenance(input);
+  return { routingProvenance: routing.report, schema: 'stage-usage-1', sourceKind: input.sourceKind, sourcePath: input.sourcePath, runId: input.runId, metric: compatible ? metric : 'incompatible-metrics',
+    rows: rows.map(row => ({ ...row, ...(routing.stageFields.get(row.evidenceKey ?? '') ?? { plannedModel: null, plannedModelSource: 'not-recorded', probeId: null }) })), verdict: conservation.status, complete: totalComplete && witnessComplete && pricingComplete,
     knownRunTotalTokens: known, knownAccountedTokens: accounted, knownUnaccountedTokens: unaccounted,
     stageTokensSum: accounted !== null && doubled !== null ? accounted + doubled : null, doubleAttributedTokens: doubled,
     runTotalTokens: totalComplete ? known : null, sourceVerifiedTotalTokens: witnessComplete && totalComplete ? known : null,

package/src/workflow-run-dispatch.ts

@@ -80,6 +80,13 @@ export interface ProbeOutcome {
   id: string | null;
   wallMs: number;
   detail: string;
+  provenance?: {
+    schema: 'wf-probe-attempts-1'; complete: boolean; totalConsidered: number;
+    attempts: Array<{ ordinal: number; model: string | null; family: BridgeFamily; wrapperInvoked: boolean;
+      outcome: 'answered' | 'failed' | 'rejected'; selected: boolean;
+      reason: 'answered' | 'timeout' | 'spawn-error' | 'no-exit-code' | 'exit-nonzero' | 'unexpected-response' | 'invalid-candidate' }>;
+  } | null;
+  provenanceReason?: 'candidate-model-invalid' | 'wrapper-result-invalid' | null;
 }
 
 export interface Dispatcher {
@@ -342,6 +349,36 @@ function codexStructuredOutput(stdout: string): { structured: boolean; valid: bo
   return { structured: true, valid: !malformed && !failedTerminal, text, usage: result, reportedModel: reportedModels.size === 1 ? [...reportedModels][0]! : null };
 }
 
+/** Observe the existing wrapper seam; this does not attest OS child start. */
+function collectProbeMetadata(family: BridgeFamily) {
+  const attempts: NonNullable<ProbeOutcome['provenance']>['attempts'] = [];
+  let totalConsidered = 0;
+  let invalid: Exclude<ProbeOutcome['provenanceReason'], undefined> = null;
+  return {
+    record(id: string, wrapperInvoked: boolean, r: ChildRun | null, selected: boolean) {
+      const ordinal = ++totalConsidered;
+      if (wrapperInvoked && (typeof id !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(id))) invalid = 'candidate-model-invalid';
+      let reason: NonNullable<ProbeOutcome['provenance']>['attempts'][number]['reason'] = 'invalid-candidate';
+      if (r !== null) {
+        const typed = typeof r.stdout === 'string' && typeof r.stderr === 'string' && typeof r.timedOut === 'boolean'
+          && (r.exitCode === null || (Number.isSafeInteger(r.exitCode) && r.exitCode >= 0))
+          && (r.spawnError === null || (typeof r.spawnError === 'string' && r.spawnError.length > 0));
+        const consistent = typed && !(r.timedOut && (r.spawnError !== null || r.exitCode === 0))
+          && !(r.spawnError !== null && r.exitCode !== null) && !(selected && (r.timedOut || r.spawnError !== null || r.exitCode !== 0));
+        if (!consistent && invalid !== 'candidate-model-invalid') invalid = 'wrapper-result-invalid';
+        reason = r.timedOut ? 'timeout' : r.spawnError !== null ? 'spawn-error' : r.exitCode === null ? 'no-exit-code'
+          : r.exitCode !== 0 ? 'exit-nonzero' : selected ? 'answered' : 'unexpected-response';
+      }
+      if (ordinal <= 32) attempts.push({ ordinal, model: wrapperInvoked ? id : null, family, wrapperInvoked,
+        outcome: !wrapperInvoked ? 'rejected' : selected ? 'answered' : 'failed', reason, selected });
+    },
+    finish(): Pick<ProbeOutcome, 'provenance' | 'provenanceReason'> {
+      return { provenance: invalid === null ? { schema: 'wf-probe-attempts-1', complete: totalConsidered <= 32, totalConsidered, attempts } : null,
+        provenanceReason: invalid };
+    },
+  };
+}
+
 // ── the adapter factories (pure over the injected ChildRunner) ───────────────────────────────────
 
 function failed(family: BridgeFamily, model: string | null, wallMs: number, reason: DispatchReason, detail: string, outcome: 'null' | 'error' = 'null'): DispatchResult {
@@ -381,12 +418,16 @@ export function makeCodexExecDispatcher(run: ChildRunner, opts?: { bin?: string;
       const t0 = clock();
       const list = candidates.length > 0 ? candidates : ['gpt-5.5'];
       const started: string[] = [];
+      const observation = collectProbeMetadata('openai');
       for (const id of list) {
+        const wrapperInvoked = true;
         const r = await run(bin, codexProbeArgv(id), { stdinText: null, timeoutMs: 120_000, cwd: isolatedCwd(), detached: true });
         started.push(id);
-        if (interpretCodexProbe(r)) return { id, wallMs: clock() - t0, detail: `codex answered on ${id}` };
+        const selected = interpretCodexProbe(r);
+        observation.record(id, wrapperInvoked, r, selected);
+        if (selected) return { id, wallMs: clock() - t0, detail: `codex answered on ${id}`, ...observation.finish() };
       }
-      return { id: null, wallMs: clock() - t0, detail: `no codex candidate answered a probe (tried: ${started.join(', ')}) — an allowlist says an id is spellable, only a probe says it answers` };
+      return { id: null, wallMs: clock() - t0, detail: `no codex candidate answered a probe (tried: ${started.join(', ')}) — an allowlist says an id is spellable, only a probe says it answers`, ...observation.finish() };
     },
     dispatch: async (req) => {
       const t0 = clock();
@@ -435,14 +476,18 @@ export function makeClaudePDispatcher(run: ChildRunner, opts?: { bin?: string; i
       const t0 = clock();
       const list = candidates.length > 0 ? candidates : ['sonnet'];
       const tried: string[] = [];
+      const observation = collectProbeMetadata('claude');
       for (const id of list) {
         const argv = claudeProbeArgs(id);
         tried.push(id);
-        if (argv === null) continue; // an unsafe id is not spellable, let alone answerable
+        if (argv === null) { observation.record(id, false, null, false); continue; } // existing unsafe rejection
+        const wrapperInvoked = true;
         const r = await run(bin, argv, { stdinText: null, timeoutMs: 120_000, cwd: isolatedCwd(), detached: true });
-        if (interpretClaudeProbe({ stdout: r.stdout, exitCode: r.exitCode ?? 1 })) return { id, wallMs: clock() - t0, detail: `claude answered on ${id}` };
+        const selected = interpretClaudeProbe({ stdout: r.stdout, exitCode: r.exitCode ?? 1 });
+        observation.record(id, wrapperInvoked, r, selected);
+        if (selected) return { id, wallMs: clock() - t0, detail: `claude answered on ${id}`, ...observation.finish() };
       }
-      return { id: null, wallMs: clock() - t0, detail: `no claude candidate answered a probe (tried: ${tried.join(', ')})` };
+      return { id: null, wallMs: clock() - t0, detail: `no claude candidate answered a probe (tried: ${tried.join(', ')})`, ...observation.finish() };
     },
     dispatch: async (req) => {
       const t0 = clock();

package/src/workflow-run.ts

@@ -43,7 +43,7 @@ import { classifyFailure, errSnap, gateVerdict, joinRegion, stepContractLines, t
 import { checkpointInputHash, decideCheckpointResume, parseCheckpointRead, serializeCheckpoint } from './feature-adr-checkpoints.js';
 import { modelFamily, type BridgeFamily } from './qe-bridge.js';
 import { buildReqeDebt } from './reqe.js';
-import { CODEX_EXEC_XHIGH_TIMEOUT_MS, defangGateEchoes, type DispatchResult, type Dispatcher } from './workflow-run-dispatch.js';
+import { CODEX_EXEC_XHIGH_TIMEOUT_MS, defangGateEchoes, type DispatchResult, type Dispatcher, type ProbeOutcome } from './workflow-run-dispatch.js';
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Schemas / constants
@@ -178,6 +178,12 @@ export interface WfBudgetRow extends Pick<DispatchResult, 'tokensTotal' | 'token
   model: string | null;
   modelProvenance?: string;
   requestedModel?: string | null;
+  plannedModel?: string | null;
+  plannedModelSource?: 'plan-declared' | 'plan-omitted' | 'unavailable';
+  probeId?: string | null;
+  probeProvenance?: Exclude<ProbeOutcome['provenance'], undefined>;
+  probeSource?: 'dispatcher-child-seam' | 'scripted-dispatcher';
+  probeObservationReason?: 'producer-not-recorded' | 'id-factory-missing' | 'id-factory-invalid' | 'provenance-invalid' | 'candidate-model-invalid' | 'wrapper-result-invalid' | 'selected-model-invalid' | null;
   wallMs: number;
   tokensIn: number | null;
   tokensOut: number | null;
@@ -936,6 +942,35 @@ export interface RunStore {
   writeReqeDebt(record: object): void;
 }
 
+const safeRoutingModel = (value: unknown): value is string => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(value);
+function probeRecordReason(probe: ProbeOutcome, family: BridgeFamily): Exclude<WfBudgetRow['probeObservationReason'], undefined> {
+  const exact = (value: unknown, keys: string[]): value is Record<string, unknown> => value !== null && typeof value === 'object'
+    && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)
+    && Reflect.ownKeys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+  if (probe.id !== null && !safeRoutingModel(probe.id)) return 'selected-model-invalid';
+  const present = [Object.hasOwn(probe, 'provenance'), Object.hasOwn(probe, 'provenanceReason')];
+  if (present.every(value => !value)) return 'producer-not-recorded';
+  if (!present.every(Boolean)) return 'provenance-invalid';
+  if (probe.provenance === null && (probe.provenanceReason === 'candidate-model-invalid' || probe.provenanceReason === 'wrapper-result-invalid')) return probe.provenanceReason;
+  const p = probe.provenance;
+  if (probe.provenanceReason !== null || !exact(p, ['schema', 'complete', 'totalConsidered', 'attempts']) || p.schema !== 'wf-probe-attempts-1'
+    || typeof p.complete !== 'boolean' || !Number.isSafeInteger(p.totalConsidered) || p.totalConsidered <= 0 || !Array.isArray(p.attempts)
+    || p.attempts.length !== Math.min(p.totalConsidered, 32) || p.complete !== (p.totalConsidered <= 32)) return 'provenance-invalid';
+  for (const [index, a] of p.attempts.entries()) {
+    if (!exact(a, ['ordinal', 'model', 'family', 'wrapperInvoked', 'outcome', 'reason', 'selected']) || a.ordinal !== index + 1
+      || a.family !== family || typeof a.wrapperInvoked !== 'boolean' || typeof a.selected !== 'boolean') return 'provenance-invalid';
+    const rejected = family === 'claude' && !a.wrapperInvoked && !a.selected && a.model === null && a.outcome === 'rejected' && a.reason === 'invalid-candidate';
+    const answered = a.wrapperInvoked && a.selected && safeRoutingModel(a.model) && a.outcome === 'answered' && a.reason === 'answered';
+    const failed = a.wrapperInvoked && !a.selected && safeRoutingModel(a.model) && a.outcome === 'failed'
+      && ['timeout', 'spawn-error', 'no-exit-code', 'exit-nonzero', 'unexpected-response'].includes(a.reason);
+    if (!(rejected || answered || failed)) return 'provenance-invalid';
+  }
+  const selected = p.attempts.filter(a => a.selected);
+  if (!p.complete ? selected.length !== 0 : probe.id === null ? selected.length !== 0
+    : selected.length !== 1 || selected[0]?.ordinal !== p.totalConsidered || selected[0]?.model !== probe.id) return 'provenance-invalid';
+  return null;
+}
+
 export interface SchedulerDeps {
   store: RunStore;
   dispatchers: Record<BridgeFamily, Dispatcher>;
@@ -944,6 +979,7 @@ export interface SchedulerDeps {
   /** Injected ISO clock (determinism, NFR-2). */
   now(): string;
   monotonicMs(): number;
+  newProbeId?: () => string;
   /**
    * TEST SEAM (named, never a casual flag): disables the landed barrier so the F5 mutant can show
    * the lying file-step passing. Default false; a run that sets it records `dispatcherOverride`.
@@ -987,6 +1023,7 @@ function failureClassOf(res: DispatchResult): FailureClass | null {
 }
 
 interface RunCtx {
+  probeIds: Partial<Record<BridgeFamily, string | null>>;
   inputs: RunnerInputs;
   pre: PreflightOk;
   deps: SchedulerDeps;
@@ -1062,15 +1099,34 @@ export async function runWorkflow(inputs: RunnerInputs, pre: PreflightOk, deps:
 
   const usedFamilies = [...new Set(Object.values(pre.families))];
   const probedIds: Partial<Record<BridgeFamily, string | null>> = {};
+  const probeIds: Partial<Record<BridgeFamily, string | null>> = {};
   let probeAgentCalls = 0;
   const probeDetail: Partial<Record<BridgeFamily, string>> = {};
   for (const family of usedFamilies) {
     const candidates = [...new Set(allSpecs(pre.projection).filter((s) => pre.families[s.stepId] === family).map((s) => s.model).filter((m): m is string => typeof m === 'string'))];
     const probe = await deps.dispatchers[family].probe(candidates);
     probeAgentCalls++;
+    let probeId: string | null = null;
+    let idReason: Exclude<WfBudgetRow['probeObservationReason'], undefined> = 'id-factory-missing';
+    if (deps.newProbeId) {
+      try {
+        const id = deps.newProbeId();
+        if (typeof id === 'string' && /^[0-9a-f]{32}$/.test(id)) {
+          probeId = id;
+          idReason = null;
+        } else idReason = 'id-factory-invalid';
+      } catch { idReason = 'id-factory-invalid'; }
+    }
+    const producerReason = probeRecordReason(probe, family);
+    const probeObservationReason = producerReason && producerReason !== 'producer-not-recorded' ? producerReason : idReason ?? producerReason;
+    probeIds[family] = probeId;
     store.appendBudgetRow({
       schema: WF_BUDGET_ROW_SCHEMA,
       kind: 'probe',
+      probeId,
+      probeProvenance: probeObservationReason === null ? probe.provenance! : null,
+      probeSource: deps.dispatcherOverride ? 'scripted-dispatcher' : 'dispatcher-child-seam',
+      probeObservationReason,
       runId: inputs.runId,
       projectRoot: inputs.projectRoot ?? inputs.cwdRoot,
       dispatchSeq: null,
@@ -1207,6 +1263,7 @@ export async function runWorkflow(inputs: RunnerInputs, pre: PreflightOk, deps:
 
   const opened = openTrace(inputs, pre, store, inputs.resume !== null);
   const ctx: RunCtx = {
+    probeIds,
     inputs,
     pre,
     deps,
@@ -1526,6 +1583,9 @@ async function dispatchOnce(
       family,
       model: res.modelUsed,
       requestedModel: model,
+      plannedModel: safeRoutingModel(spec.model) ? spec.model : null,
+      plannedModelSource: safeRoutingModel(spec.model) ? 'plan-declared' : spec.model == null ? 'plan-omitted' : 'unavailable',
+      probeId: ctx.probeIds[family] ?? null,
       modelProvenance: res.modelProvenance ?? (res.modelUsed === null ? 'not-recorded' : 'dispatcher-reported'),
       wallMs,
       tokensIn: res.tokensIn,