@edgehero/pi-dispatch 2.0.0 → 3.0.0

package/src/subscriptions.mjs

@@ -1,8 +1,12 @@
 /**
  * Operator-declared subscription plans (issue #53): the one place a flat-rate plan's real price can be
- * stated. Subscription-backed providers ship all-zero rate tables (pi-ai's kimi-coding and zai-coding-cn
- * both do), so their runs record cost 0 and read as FREE when they are PREPAID -- and the env boundary
- * REFUSES OAuth/subscription logins on purpose (env-allowlist.mjs: an expiring token cannot power an
+ * stated. pi-ai's rate table for a subscription-backed provider does not state the plan's price: at 0.80.7
+ * kimi-coding and zai-coding-cn shipped all-zero tables, so their runs recorded cost 0 and read as FREE
+ * when they were PREPAID; at the 0.99.1 pin most of their models carry an implied API-equivalent rate
+ * instead (issue #509), so the same prepaid runs now record a POSITIVE cost and read as METERED spend.
+ * Either way the table is the wrong price, and a zero rate is no longer even a hint that a plan exists
+ * (the qwen-token-plan family is all-zero, and so are free models of metered providers). And the env
+ * boundary REFUSES OAuth/subscription logins on purpose (env-allowlist.mjs: an expiring token cannot power an
  * unattended service), so no credential ever reaches the worker that could name the plan. An operator-side
  * declaration is therefore the only honest price source, and `subscriptions.json` is that declaration.
  *

package/src/triggers-file.mjs

@@ -433,7 +433,8 @@ export function makeCheckOnceSpent({ triggersPath, fs = nodeFs }) {
 }
 
 /**
- * Detect the version skew `run.waitFor` opens (issue #230), pre-spend, from the worker's own file read.
+ * Detect the version skew `run.waitFor` opens (issue #230), pre-spend, from the worker's own file read, and the
+ * same skew for every field in `AUTHORED_NARROWING_FIELDS` (issue #502).
  *
  * The hazard is `DES-TRIGGERS-UNIFIED-FILE`'s widening rule arriving somewhere it has never bitten. Unknown
  * keys DROP, which for every previous field was a harmless no-op: an old parser meeting `run.image` gives
@@ -455,6 +456,27 @@ export function makeCheckOnceSpent({ triggersPath, fs = nodeFs }) {
  * "run", because a broken read must never wedge every job. Only a positive, identity-confirmed mismatch --
  * this entry authored conditions, this job carries none -- refuses.
  */
+/**
+ * The authored NARROWING fields the skew check covers besides `waitFor` (issues #502, #501): a `run` key whose absence
+ * WIDENS the job, so a service that drops it (a receiver below the version floor, or a current one reading a dead
+ * inode through compose's single-file `:ro` mount) turns a narrowed trigger into an unrestricted job that records
+ * as a clean run. `authored` says whether the entry in the file carries the field; the job is skewed when it does
+ * and the job arrived with the key absent or null. A new field of this class is ONE row here. `waitFor` keeps its
+ * own branch below because its refusal counts conditions and has its own reason (`wait-skew`); every row here is
+ * refused as `trigger-skew`, naming the field.
+ *
+ * The job checked must be the job as it ARRIVED (`job.data`), never one the worker filled: the effective job
+ * carries the deployment's PI_ALLOWED_MODELS as `models`, which would hide exactly the drop this exists to see.
+ * index.mjs hands this check the arrived value.
+ */
+export const AUTHORED_NARROWING_FIELDS = Object.freeze([
+	Object.freeze({ key: "models", authored: (v) => Array.isArray(v) && v.length > 0 }),
+	// Issue #501: a trigger's per-job dollar cap. Dropped by a receiver from before #501 (which tolerated the key as
+	// unknown), the job would run under the deployment's wider cap, or with none, on a clean record. Any present
+	// value counts as authored; whether it is a valid amount is the loader's question, not this one.
+	Object.freeze({ key: "maxCostUsd", authored: (v) => v !== undefined && v !== null }),
+]);
+
 export function makeCheckWaitSkew({ triggersPath, fs = nodeFs }) {
 	// Cached by mtime, unlike `checkOnceSpent` which re-reads every time. The difference is which jobs each
 	// one runs for: the one-shot check is gated on `matched.once === true`, so it is rare by construction and
@@ -478,19 +500,28 @@ export function makeCheckWaitSkew({ triggersPath, fs = nodeFs }) {
 		}
 	};
 
+	// STRICT, like `waitFor` since #230 (PR #536's review, round 3): a job whose authored entry carries a narrowing
+	// field it arrived without is refused, even when the operator ADDED that field after the job was queued. A
+	// fail-open fenced on the file's mtime was tried and removed: ANY later write of the file (the worker's own
+	// one-shot disarm, a console edit, a touch, an `rsync -t` mtime in the future) reopened the hole for every job.
+	// Refusing a job queued before the edit is the safe direction, and its comment says to re-run it.
 	return async function checkWaitSkew(job) {
 		if (typeof triggersPath !== "string" || triggersPath === "") return { ok: true };
 		// Cron and CLI jobs carry no matched index, and cannot carry `waitFor` at all.
 		const index = job?.trigger?.matched?.index;
 		if (!Number.isInteger(index)) return { ok: true };
 		// The field arrived. Whether its conditions are SATISFIED is the gate's business, not this check's.
-		if (Array.isArray(job?.waitFor) && job.waitFor.length > 0) return { ok: true };
+		const waitArrived = Array.isArray(job?.waitFor) && job.waitFor.length > 0;
+		const missing = AUTHORED_NARROWING_FIELDS.filter((row) => job?.[row.key] === undefined || job[row.key] === null);
+		if (waitArrived && missing.length === 0) return { ok: true };
 
 		const triggers = read();
 		if (triggers === null) return { ok: true };
 		const entry = triggers[index];
 		const authored = entry?.run?.waitFor;
-		if (!Array.isArray(authored) || authored.length === 0) return { ok: true };
+		const waitSkewed = !waitArrived && Array.isArray(authored) && authored.length > 0;
+		const dropped = missing.find((row) => row.authored(entry?.run?.[row.key]));
+		if (!waitSkewed && dropped === undefined) return { ok: true };
 
 		// The identity guard readDisarmState keeps, and WIDER than flow alone. `triggerIndex` is a RAW array
 		// position, so an insertion, a reorder, or a stray `triggers.json` at the worker's cwd can all put a
@@ -505,7 +536,37 @@ export function makeCheckWaitSkew({ triggersPath, fs = nodeFs }) {
 		const onType = job?.trigger?.matched?.type;
 		if (typeof onType === "string" && entry?.on?.type !== onType) return { ok: true };
 
-		return { skewed: true, conditions: authored.length };
+		if (waitSkewed) return { skewed: true, conditions: authored.length };
+		return { skewed: true, field: dropped.key };
+	};
+}
+
+/**
+ * Issue #505: `(job) => boolean`, whether the LIVE triggers file still flags the job's cron trigger
+ * `run.portfolio: true`. A portfolio job is queued with the flag on its data (a scheduler tick, or
+ * `pi-dispatch run --trigger`), and the flag is budget authority, so the data alone is never trusted: the operator
+ * removing the flag from the reviewed file must take effect for a job already queued.
+ *
+ * The same file the one-shot checks read (`PI_TRIGGERS_FILE`, else `./triggers.json` in the worker's working
+ * directory), parsed by the shared validator rather than read raw, because the answer gives authority and an entry
+ * the loader would refuse grants none. Found by the cron id, which the loader keeps unique, never by an index, and then
+ * held to the job: the entry's `folder`, `flow`, `command` and `task` must equal the job's. An id is a name, and a
+ * name can be reused: a job queued from an old entry must not borrow the flag of a different entry that took its id
+ * later (review of PR #575). Every doubt (no path, no file, a file that does not parse, no cron entry with that id, an
+ * entry that is not the one the job came from) answers false: the job then runs as an ordinary cron job, the direction
+ * that grants nothing. Never throws.
+ */
+export function makeCheckPortfolioFlag({ triggersPath, fs = nodeFs }) {
+	return function checkPortfolioFlag(job) {
+		const id = job?.trigger?.id;
+		if (typeof triggersPath !== "string" || triggersPath === "" || typeof id !== "string") return false;
+		try {
+			const entry = parseTriggers(fs.readFileSync(triggersPath, "utf8"), triggersPath).find((t) => t.on.type === "cron" && t.on.id === id);
+			if (entry?.run?.portfolio !== true) return false;
+			return ["folder", "flow", "command", "task"].every((k) => entry.run[k] === job[k]);
+		} catch {
+			return false;
+		}
 	};
 }
 

package/src/triggers.mjs

@@ -32,14 +32,20 @@ import { imageRefProblem } from "./image-ref.mjs";
 import { SKILL_NAME_RE } from "./flow-gate.mjs";
 import { FORGE_HOST_VARS, FORGE_KINDS, MINTED_TOKEN_VARS, RUN_KINDS, forgeSpec, isForgeKind } from "./forges.mjs";
 import { findDuplicateKey } from "./json-duplicates.mjs";
+import { validateModelRef } from "./model-ref.mjs";
+import { parseUsdMicros } from "./money.mjs";
 import { PROVIDER_STEERING_VARS } from "./provider-steering.mjs";
-import { CONTAINER_ENV_NAMES } from "./reserved-env.mjs";
+import { CONTAINER_ENV_NAMES, RUNNER_ENV_NAMES } from "./reserved-env.mjs";
 // The wait grammar's two shared halves (issue #230). `afterInstantMs` is imported rather than restated so
 // the loader and the pickup gate cannot disagree about what a legal instant is: a second spelling here is
 // how a file that loads clean starts holding for an instant nobody wrote. wait-for.mjs is pure and
 // fs-free, so importing it keeps parseTriggers pure.
 import { WAIT_CONDITION_KEYS, WAIT_CONDITION_MAX, afterInstantMs } from "./wait-for.mjs";
 
+// Re-exported so the console checks a provider or model it is about to write with the loader's own
+// grammar, through the subpath it already imports, rather than a copy that could drift.
+export { validateModelRef };
+
 // EXPORTED for the same reason as PR_ACTIONS: the admin re-states this vocabulary to a MODEL.
 export const ON_TYPES = new Set(["cron", "label", "comment", "pull_request", "issue"]);
 
@@ -167,7 +173,10 @@ export const REVIEW_STATES = new Set(["approved", "changes_requested", "commente
 const REVIEW_ACTION = "review_submitted";
 
 /**
- * The pi tool names a trigger may exclude (issue #291) -- the built-in set of the PINNED pi, 0.80.7.
+ * The pi tool names a trigger may exclude (issue #291) -- the built-in set of the PINNED pi, 0.99.1, in pi's
+ * own `allToolNames` order. `powershell` joined it at the 0.99.1 bump (issue #509): pi registers it as a
+ * built-in but does not activate it by default (`DEFAULT_TOOL_NAMES` is read, bash, edit, write), so a
+ * trigger that means "no shell" names it beside `bash`.
  * Hand-written because this validator is pure and pi-free (the worker does not depend on the agent
  * package), and therefore BOLTED twice to the artifact it restates: `worker/test/exclude-tools.pinned.test.mjs`
  * and `image/runner/test/pinned-api.test.mjs` both derive the set from the pinned package and fail with a
@@ -177,7 +186,7 @@ const REVIEW_ACTION = "review_submitted";
  * validation exists to close -- pi ignores unknown names in `excludeTools` without a diagnostic.
  */
 // EXPORTED for the two pinned-set bolts and for the admin, which states the vocabulary to an operator.
-export const EXCLUDABLE_TOOL_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "ls"]);
+export const EXCLUDABLE_TOOL_NAMES = new Set(["read", "bash", "powershell", "edit", "write", "grep", "find", "ls"]);
 
 // A cron id flows into BullMQ's deterministic `repeat:<id>:<nextMillis>` jobId, so a `:` corrupts that
 // parse; the charset also excludes `:` and the dedicated check names the reason.
@@ -225,7 +234,7 @@ const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
  * Every set is IMPORTED, never retyped, which is the rule `sandbox.test.mjs` keeps for the same reason: a
  * forge added to the table later must not need a second edit here to stay covered.
  */
-const RESERVED_ENV_NAMES = new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES, ...PROVIDER_STEERING_VARS]);
+export const RESERVED_ENV_NAMES = new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES, ...RUNNER_ENV_NAMES, ...PROVIDER_STEERING_VARS]);
 
 function isNonEmptyString(value) {
 	return typeof value === "string" && value.trim() !== "";
@@ -307,6 +316,13 @@ function normalizeTrigger(entry, index, path, state) {
 	if (!isForgeKind(run.kind)) {
 		throw configError(`${at}: a ${on.type} trigger is webhook-driven and produces a forge job; run.kind must be one of ${FORGE_KINDS.join("|")} (got ${JSON.stringify(run.kind)}): ${path}`);
 	}
+	// Issue #505: `run.portfolio` is cron-only, refused here for every webhook type at once (and before the disarmed
+	// sentinel below, so a disarmed entry carrying it still refuses the file). A forge job is driven by text an issue or
+	// pull request author chose, and it has no `/outbox`, so a plan channel there would hand budget authority to whoever
+	// can open an issue. Any value is refused, `false` included: on a webhook kind the field has no meaning to state.
+	if (run.portfolio !== undefined) {
+		throw configError(`${at}: run.portfolio is only available on a cron trigger: a ${on.type} trigger runs on text a forge user wrote, and a budget plan must come from a schedule the operator reviewed: ${path}`);
+	}
 	let normalized;
 	if (on.type === "label") normalized = normalizeLabel(on, run, index, path);
 	else if (on.type === "comment") normalized = normalizeComment(on, run, index, path, state);
@@ -398,6 +414,12 @@ function normalizeCron(on, run, index, path, state) {
 	// A cron job's session narrows like any other: the field selects what the container's agent can do,
 	// which is orthogonal to what triggered it (issue #291).
 	const excludeTools = validateExcludeTools(on, run, `cron trigger "${id}"`, path);
+	// Validated since #502; before it these three were copied untouched, so `run.provider: 7` loaded.
+	const ref = validateRunModel(on, run, `cron trigger "${id}"`, path);
+	// Issue #505: the portfolio flag. Strictly boolean, the house rule (`run.github`'s reason: a truthy string must not
+	// quietly arm budget authority). `true` beside `run.command` is refused: a plan is written by a flow's judgement,
+	// and a command has no committed skill to review. `false` is today's default and is carried, `run.resume`'s rule.
+	const portfolio = validatePortfolio(run, command, `cron trigger "${id}"`, path);
 
 	// provider/model/maxTurns stay absent when omitted so the value resolves at job start against the
 	// settings overlay/env, not a default frozen here (INT-CONFIG-OVERLAY-CONTRACT). github/packages/image stay
@@ -406,10 +428,27 @@ function normalizeCron(on, run, index, path, state) {
 	// freeze today's default into every stored repeatable.
 	return {
 		on: { type: "cron", id, pattern },
-		run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
+		run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: ref.provider, model: ref.model, maxTurns: ref.maxTurns, github: run.github, packages, image, resume, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...(ref.models !== undefined && { models: ref.models }), ...(ref.maxCostUsd !== undefined && { maxCostUsd: ref.maxCostUsd }), ...(portfolio !== undefined && { portfolio }) },
 	};
 }
 
+/**
+ * `run.portfolio` on a cron trigger (issue #505): the job may send a priorities plan back through
+ * `/outbox/priorities.json`. Returns the flag, or undefined when absent, so an unflagged entry normalizes
+ * byte-identically. Reviewed-file-only, like `run.secrets`: no tool and no panel key writes it.
+ */
+function validatePortfolio(run, command, at, path) {
+	const portfolio = run.portfolio;
+	if (portfolio === undefined) return undefined;
+	if (typeof portfolio !== "boolean") {
+		throw configError(`${at}: run.portfolio must be true or false when present: ${path}`);
+	}
+	if (portfolio === true && command !== undefined) {
+		throw configError(`${at}: run.portfolio cannot be set beside run.command: a budget plan is written by a flow's judgement, and a command has no committed skill to review: ${path}`);
+	}
+	return portfolio;
+}
+
 /**
  * Validate the per-trigger `run.packages` flag, shared by all four normalizers. It is an opt-OUT: the pi
  * packages an operator pinned into the global overlay load for every job, and `run.packages: false` is how a
@@ -1169,6 +1208,94 @@ function validateBackend(on, run, at, path, { localWorkspace }) {
 	return backend;
 }
 
+/**
+ * The `run` field a key spells or nearly spells (`run.provider`, `run.model`, `run.models`, `run.maxTurns`,
+ * `run.maxCostUsd`), or null. The exact field names match too: the CALLER decides whether an exact name is legal
+ * where it found it (the loader allows them under `run`, never under `on`; the console's trigger tools refuse
+ * `run.models` and `run.maxCostUsd` in any spelling, issue #501 part 7). One sweep, so the two cannot disagree on
+ * what a near miss is.
+ */
+export function runModelFieldNearMiss(key) {
+	// What the sweep compares against, case and separators removed. `providerid` and `modelid` are what an
+	// operator copies from a provider's own API docs; `allowedmodels` is the issue's own name for the list.
+	// Deliberately NOT a synonym hunt (`llm`, `engine`): that is the general unknown-key sweep this file's
+	// forward-compatibility posture rejects.
+	// Singular and plural of each, excludeTools' rule: `maxTurn` and `providers` are one grammatical step
+	// from the field, and `modelName` is how several provider SDKs spell the id.
+	const targets = RUN_MODEL_NEAR_MISS_TARGETS;
+	const isSubsequence = (needle, hay) => {
+		let i = 0;
+		for (const ch of hay) if (i < needle.length && needle[i] === ch) i++;
+		return i === needle.length;
+	};
+	const normalized = String(key).replace(/[^a-z0-9]/gi, "").toLowerCase();
+	// The homoglyph branch is validateBackend's (its comment carries the rationale), floor 4 included:
+	// `m<U+043E>del` normalizes to `mdel`, and a floor of 5 would let the shortest target's likeliest
+	// homoglyph through. Only a non-ASCII key reaches this branch, so no ASCII field is at risk.
+	// The suggestion names the target that actually MATCHED, so a homoglyph key is pointed at the field
+	// its surviving letters spell rather than at whatever a prefix test would guess.
+	const hit = /^[\x20-\x7E]*$/.test(key)
+		? (Object.hasOwn(targets, normalized) ? normalized : undefined)
+		: normalized.length >= 4 ? Object.keys(targets).find((t) => isSubsequence(normalized, t)) : undefined;
+	return hit === undefined ? null : targets[hit];
+}
+
+const RUN_MODEL_NEAR_MISS_TARGETS = Object.freeze({
+	provider: "run.provider", providers: "run.provider", providerid: "run.provider", providerids: "run.provider", providername: "run.provider",
+	model: "run.model", modelid: "run.model", modelname: "run.model",
+	models: "run.models", modelids: "run.models", modelnames: "run.models", allowedmodels: "run.models", allowedmodel: "run.models",
+	maxturns: "run.maxTurns", maxturn: "run.maxTurns",
+	maxcostusd: "run.maxCostUsd", maxcost: "run.maxCostUsd",
+});
+
+/**
+ * `run.provider`, `run.model` and `run.maxTurns` (issue #502): which model this trigger's job runs on, and
+ * its turn limit. Every kind carries them; before #502 only cron did, and unchecked.
+ *
+ * The value grammar is `model-ref.mjs`'s, shared with the console. This wrapper adds the KEY sweep, in
+ * `validateExcludeTools`' shape and for its reason: a misspelled `run.modelId` loads clean and the job runs
+ * on the deployment default model while the file reads as though it chose one. That is a destructive
+ * absence once a model is policy, and the price difference between two models is the whole point of
+ * naming one.
+ *
+ * `run.maxCostUsd` (issue #501) is validated here too, since the sweep below already owns its near misses:
+ * the per-job dollar cap, a plain decimal string or number (`parseUsdMicros`: above 0, at most 1,000,000,
+ * at most 6 decimals), carried AS WRITTEN and emitted only when present (`null` is absent, the model keys'
+ * rule). It can only NARROW: the worker runs the job under the smaller of it and the deployment's cap, and
+ * refuses a file with one above the env cap when it loads it (`loadSchedules`, at boot and on a live reload;
+ * this loader stays pure, so it cannot read env).
+ *
+ * `run.models` (the allowed-model list) is validated with them since #502's second part, and its misspellings
+ * were refused here before it was.
+ */
+function validateRunModel(on, run, at, path) {
+	const exact = new Set(["provider", "model", "maxTurns", "models", "maxCostUsd"]);
+	for (const [label, source, exactIsLegal] of [
+		["run", run, true],
+		["on", on, false],
+	]) {
+		for (const key of Object.keys(source ?? {})) {
+			if (exactIsLegal && exact.has(key)) continue;
+			const meant = runModelFieldNearMiss(key);
+			if (meant === null) continue;
+			throw configError(`${at}: ${label}.${key} is not a field -- did you mean ${meant}? A model choice the loader drops runs the job on the deployment default while the file reads as though it chose, so a near miss is refused rather than dropped: ${path}`);
+		}
+	}
+	return { ...validateModelRef(run, at, path), ...validateMaxCostUsd(run, at, path) };
+}
+
+// `run.maxCostUsd` (issue #501): `{ maxCostUsd }` when present and valid, `{}` when absent or null. The
+// refusal names the trigger and the key and never the value, `parseUsdMicros`' rule.
+function validateMaxCostUsd(run, at, path) {
+	if (run?.maxCostUsd === null || run?.maxCostUsd === undefined) return {};
+	try {
+		parseUsdMicros(run.maxCostUsd, "run.maxCostUsd");
+	} catch (error) {
+		throw configError(`${at}: ${error.message}: ${path}`);
+	}
+	return { maxCostUsd: run.maxCostUsd };
+}
+
 /**
  * `run.excludeTools` -- pi tool names this trigger's session must NOT have (issue #291).
  *
@@ -1414,9 +1541,10 @@ function normalizeLabel(on, run, index, path) {
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const ref = validateRunModel(on, run, at, path);
 	return {
 		on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...ref },
 	};
 }
 
@@ -1455,9 +1583,10 @@ function normalizeComment(on, run, index, path, state) {
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const ref = validateRunModel(on, run, at, path);
 	return {
 		on: { type: "comment", phrase: on.phrase },
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...ref },
 	};
 }
 
@@ -1523,6 +1652,7 @@ function normalizeIssue(on, run, index, path) {
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const ref = validateRunModel(on, run, at, path);
 	return {
 		on: {
 			type: "issue",
@@ -1532,7 +1662,7 @@ function normalizeIssue(on, run, index, path) {
 			...(number !== undefined && { number }),
 			...(once !== undefined && { once }),
 		},
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...ref },
 	};
 }
 
@@ -1609,6 +1739,7 @@ function normalizePullRequest(on, run, index, path) {
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
 	const excludeTools = validateExcludeTools(on, run, at, path);
+	const ref = validateRunModel(on, run, at, path);
 	return {
 		on: {
 			type: "pull_request",
@@ -1623,7 +1754,7 @@ function normalizePullRequest(on, run, index, path) {
 			...(number !== undefined && { number }),
 			...(once !== undefined && { once }),
 		},
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }), ...ref },
 	};
 }