@event4u/agent-config 5.10.1 → 6.0.0

package/docs/decisions/ADR-072-codex-gemini-drive-configs.md

@@ -0,0 +1,90 @@
+---
+adr: 072
+status: accepted
+date: 2026-06-08
+decision: codex-gemini-drive-configs
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-072 — Codex + Gemini drive configs
+
+## Status
+
+**Accepted** · 2026-06-08. Implementation follow-up to
+[`ADR-070`](ADR-070-tier1-drive-loop.md), which shipped the unified drive loop
+with the `claude-code` config and left `codex` / `gemini` as v1 debt. This is a
+**mechanical extension**, not a new design decision: the unified `drive()` is
+unchanged; each host adds a `build_args` + envelope parser. No AI-council round
+was needed — the only unknowns were the two CLIs' envelope shapes, which are
+**facts to verify, not trade-offs to debate** (per `think-before-action`).
+
+## Context
+
+`workspace_drive.py` (ADR-070) drives one Tier-1 turn through a per-host config.
+All three Tier-1 hosts (Claude Code / Codex / Gemini — ADR-023) are now CLI-
+present; the launch integration (ADR-071) already drives any `effective_tier==1`
+host, so adding the two configs lights up codex / gemini end-to-end with **no
+Node change**.
+
+## Decision
+
+Add `codex` and `gemini` to `HOST_CONFIGS`, refactoring the per-host hook from
+`normalise(dict)` to `parse(stdout)` so a host can own a multi-line stream
+(codex) rather than a single JSON object.
+
+**Envelope shapes — verified, not guessed:**
+
+| Host | Invocation | Shape | Text key | Usage | Session |
+|---|---|---|---|---|---|
+| `claude-code` | `claude -p <p> --output-format json` | single JSON | `result` | `usage.{input,output}_tokens` | `session_id` |
+| `codex` | `codex exec --json <p>` | **NDJSON** event stream | last `item.completed` → `item.content[].text` | `turn.completed.usage` | `session.created.session_id` |
+| `gemini` | `gemini -p <p> --output-format json` | single JSON | `response` | `stats.models.<model>.tokens` (model name dynamic) | `session_id` |
+
+- **Codex** shape is reused verbatim from the actively-used
+  `ai_council.clients.OpenAICliClient` parser (`item.completed` /
+  `turn.completed` / `session.created`); unknown events are skipped, event
+  order is tolerated. Missing assistant text → fail-closed (`bad-envelope`).
+- **Gemini** shape was confirmed by a live `gemini -p … --output-format json`
+  probe (2026-06-08): top-level `response` + `session_id`, token usage nested
+  under `stats.models.<dynamic-model>.tokens` (take the first model entry
+  best-effort; `output ≈ total − prompt`). Missing `response` → fail-closed.
+- **Tool calls** stay opaque (recorded, never executed) — same as ADR-070.
+
+## Consequences
+
+- A workspace launch (ADR-071) against `host: "codex"` or `host: "gemini"` now
+  drives a real turn when the CLI is on PATH; no other code path changes.
+- The drift-detection posture from ADR-070 extends to all three hosts: an
+  opt-in contract test per host (skipped when the CLI is absent) catches a
+  vendor-side envelope rename the moment it runs where the CLI is present.
+- The `parse(stdout)` refactor is backwards-compatible: the claude config's
+  behaviour and the uniform turn shape are unchanged.
+
+## Alternatives considered
+
+- **Guess the gemini envelope from the contract prose** — rejected: the exact
+  keys (`response`, nested `stats.models`) are not documented in-repo; a live
+  probe is cheap and removes the guess (`think-before-action`).
+- **Per-host `drive_*` functions** — rejected again (ADR-070 decision 3): the
+  variance is CLI flags + envelope parsing, both already captured by the config
+  table; control flow stays single.
+- **Pass `--model` to codex / gemini** — deferred: the drive loop uses each
+  host's default model in v0; model selection is a later concern.
+
+## Deferred to v1 (debt)
+
+Inherited from ADR-070: multi-turn / tool execution, drive metrics +
+kill-switch, error-taxonomy refinement. Plus: explicit model selection per
+host, and a normalised cross-host `usage` schema (codex/claude expose
+input/output tokens directly; gemini is derived).
+
+## References
+
+- [`ADR-070`](ADR-070-tier1-drive-loop.md) — the unified drive loop (claude-code config).
+- [`ADR-071`](ADR-071-launch-drive-integration.md) — the launch integration that drives any tier-1 host.
+- [`ADR-023`](ADR-023-host-agent-protocol.md) — the three Tier-1 hosts.
+- [`host-agent-protocol`](../contracts/host-agent-protocol.md) — envelope-as-contract + fail-closed posture.
+- `src/scripts/ai_council/clients.py` — the proven claude / codex CLI envelope parsers reused here.

package/docs/decisions/ADR-073-drive-health-kill-switch.md

@@ -0,0 +1,81 @@
+---
+adr: 073
+status: accepted
+date: 2026-06-08
+decision: drive-health-kill-switch
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-073 — Drive health + kill-switch (v0)
+
+## Status
+
+**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
+gpt-4o, design mode, 2026-06-08). Closes the observability + kill-switch gap the
+drive-loop councils (ADR-070/071/072) repeatedly flagged: there was no way to
+see "this host keeps timing out" and no automatic degrade when a host CLI goes
+bad.
+
+## Context
+
+Every Tier-1 drive (ADR-070/071/072) writes one session record — `host.turn`
+(success) or `host.error` (`error_kind` ∈ timeout / cli-missing / nonzero-exit
+/ bad-envelope / …). That store is the **canonical** history, but it is
+encrypted and per-session; the kill-switch needs a *cheap, frequent* read on
+every launch ("is this host healthy enough to drive?"). Scanning session files
+per launch is the wrong shape.
+
+## Decision
+
+Add `workspace_drive_health.py`: a tiny per-host **cache** counter at
+`<writeRoot>/workspace/health/<host>.json`, plus a kill-switch.
+
+| # | Question | Verdict | Rationale |
+|---|---|---|---|
+| 1 | Metrics source | **Dedicated counter file, as a cache.** Session log stays canonical; a missing / unreadable cache **fails open** (host treated as healthy). Minimal schema (`consecutive_failures`, `killed`, lifetime totals, last outcome) — no histograms. | The kill-switch needs O(1) reads; deriving from encrypted session scans per launch is wrong. The cache never fabricates a kill. |
+| 2 | Kill-switch trigger | **Auto + manual.** Auto-trips at **5 consecutive failures**; a manual `kill` forces it. | A consecutive-failure streak is simpler than windowing math; 5 lets transient blips self-heal while a broken CLI trips fast. |
+| 3 | State + reset | On-disk per host; **manual reset only** in v0. A success resets the *streak* but not a tripped `killed` flag. | Auto-cooldown / probe-drive risks flapping with no data on real failure modes yet — that is a v1 feature. |
+| 4 | Enforcement | **Single point in `POST /launch`**: before driving a tier-1 host, consult health; killed → skip the drive, append `host.error(host-killed)`, degrade to the inbox (same path as a drive failure). Never mutates the detected tier. | One synchronous fallback, not a tier mutation a poller has to observe. |
+| 5 | Surface | CLI (`record` / `status` / `kill` / `reset`) + a `host_killed` flag on the launch response **+ a read-only `GET /api/v1/workspace/drive-health`**. | The GUI needs health data; without the endpoint it would read the JSON file directly and bypass the surface. The endpoint is ~10 lines reading the same data the CLI does. |
+
+**Concurrency:** writes are atomic (temp file + `os.replace`) so a concurrent
+reader never sees a partial file. The read-modify-write increment is best-effort
+under true concurrency (a lost increment is acceptable — the session log is
+canonical); drives are launch-paced in v0, so contention is rare.
+
+## Consequences
+
+- A host that fails 5 drives in a row auto-routes its launches to the Tier-3
+  inbox until an operator runs `reset` — a broken host CLI no longer burns turn
+  after turn.
+- `GET /drive-health` gives the GUI (and an operator) a per-host snapshot
+  without reading the canonical (encrypted) session log.
+- The cache is non-authoritative: deleting `workspace/health/` resets the
+  kill-switch state with no data loss (the session log retains the history).
+
+## Alternatives considered
+
+- **Derive metrics from session records on demand** — rejected as the primary
+  source: O(sessions) encrypted scans on every launch. (It remains the
+  canonical reconciliation source for a future v1 audit.)
+- **Auto-cooldown + probe-drive recovery** — deferred to v1: no data yet on
+  whether hosts flap; manual reset is the conservative v0 choice.
+- **Failure-rate window instead of a streak** — deferred: windowing math is
+  v0 over-engineering; a consecutive-streak is enough to catch a dead CLI.
+- **No HTTP endpoint (CLI only)** — rejected (council): the GUI would read the
+  file directly and bypass the surface; the endpoint is cheap.
+
+## Deferred to v1 (debt)
+
+Auto-cooldown + probe-drive recovery, failure-rate windows, per-error-kind
+weighting (a `bad-envelope` may warrant a faster trip than a transient
+`timeout`), and reconciliation of the cache against the canonical session log.
+
+## References
+
+- [`ADR-070`](ADR-070-tier1-drive-loop.md) / [`ADR-071`](ADR-071-launch-drive-integration.md) / [`ADR-072`](ADR-072-codex-gemini-drive-configs.md) — the drive loop this instruments.
+- [`ADR-064`](ADR-064-append-jsonl-per-record-encryption.md) — the canonical encrypted session store.
+- [`daily-workspace`](../contracts/daily-workspace.md) — workspace surface (lists `/drive-health`).

package/docs/decisions/ADR-074-drive-kill-switch-auto-recovery.md

@@ -0,0 +1,84 @@
+---
+adr: 074
+status: accepted
+date: 2026-06-08
+decision: drive-kill-switch-auto-recovery
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-074 — Drive kill-switch auto-cooldown recovery (v1)
+
+## Status
+
+**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
+gpt-4o, design mode, 2026-06-08). Implements the auto-recovery that
+[`ADR-073`](ADR-073-drive-health-kill-switch.md) explicitly deferred to v1, and
+**amends** ADR-073's decision 3 ("manual reset only"): an *auto*-tripped host
+now self-recovers via a half-open probe; a *manual* kill stays sticky.
+
+## Context
+
+ADR-073's kill-switch was manual-reset-only — a tripped host stayed inbox-only
+until an operator ran `reset`. That is operator toil once the underlying problem
+clears. This v1 adds a classic circuit-breaker half-open recovery.
+
+## Decision
+
+| # | Question | Verdict | Rationale |
+|---|---|---|---|
+| 1 | State model | **Three-state `gate(host)` → closed / open / half_open** (via `killed_at` + cooldown). Cache miss → `closed` (fail open). | The launch path switches on the gate; the boolean `is_killed` becomes a status read. |
+| 2 | Probe mechanism | **Reuse the next real launch** as the probe. async / synthetic probe = v2. | This is a **local single-user** workspace, not a high-traffic service — the one user paying a probe's latency ~once per cooldown is acceptable; an async probe runner is disproportionate for v1. The council's UX concern is noted and the feature is flag-gated as the escape hatch. |
+| 3 | Success semantics | A success **closes** an *auto*-tripped circuit (un-kills); a *manual* kill is never auto-cleared. Safe because a real drive only runs when closed/half-open. | Auto-recovery without operator toil; manual intent is preserved. |
+| 4 | Probe failure | Re-open, restart the cooldown (**fixed**, no back-off in v1) and `trip_count += 1`. **Flapping guard:** at `MAX_AUTO_TRIPS = 3` the host goes **sticky** (manual reset only). | Bounds a misconfigured host probing forever and burning quota. |
+| 5 | Cooldown | **Env-tunable** `AGENT_CONFIG_DRIVE_COOLDOWN_SEC` (default **600 s**), global; no per-host override. | A wrong default is an env flip (30 s), not a code deploy; per-host is over-engineering. |
+| 6 | Manual kill | **Sticky** (`kill_reason: "manual"`) — never auto-recovers. Only auto-trips (`"auto"`) take the cooldown path. | A manual kill encodes out-of-band knowledge ("broken until I fix it"); auto-healing it would fight the operator. |
+
+**Escape hatch (council: mandatory):** the whole behaviour is behind
+`AGENT_CONFIG_DRIVE_AUTO_RECOVERY` (default on; `0/false/off` → ADR-073 v0
+manual-only). **Concurrency:** a `probe_started_at` time-lease (`PROBE_LEASE_SEC
+= 120`) makes a concurrent launch see `open` instead of firing a second
+simultaneous probe — adequate for launch-paced single-user writes; a full
+compare-and-swap lock is v2. **Observability:** `record(..., is_probe=True)` +
+`last_was_probe` distinguish probe outcomes from normal drives.
+
+## Launch enforcement
+
+`POST /launch` calls `gate(host)` before driving: `open` → skip + inbox
+(`host.error(host-killed)`); `half_open` → drive ONE probe, record with
+`is_probe`, response carries `recovered: true` on a successful probe; `closed`
+→ normal drive. One enforcement point, unchanged from ADR-073.
+
+## Consequences
+
+- An auto-tripped host recovers on its own once the problem clears — no operator
+  toil for transient outages.
+- A genuinely broken host trips → probes → re-trips up to `MAX_AUTO_TRIPS`, then
+  goes sticky so it stops burning probes until an operator intervenes.
+- A manual `kill` behaves exactly as before (sticky); the escape-hatch flag
+  restores full v0 behaviour.
+
+## Alternatives considered
+
+- **Async / synthetic background probe** (council's preferred UX) — deferred to
+  v2: needs a background task runner; disproportionate for a local single-user
+  tool where the probe-latency cost lands on at most one user per cooldown.
+- **Exponential cooldown back-off** — deferred to v2: fixed cooldown + the
+  `MAX_AUTO_TRIPS` sticky guard already bounds flapping.
+- **Auto-recovering manual kills** — rejected: a manual kill is an operator
+  decision that auto-healing would override.
+- **Hard-coded cooldown** — rejected: env-tunability is three lines and turns a
+  wrong default into a 30-second fix.
+
+## Deferred to v2 (debt)
+
+Async / synthetic probe (decouple recovery from a user launch), full
+compare-and-swap probe lock, per-host cooldown override, exponential back-off,
+per-error-kind trip weighting, cache↔session-log reconciliation.
+
+## References
+
+- [`ADR-073`](ADR-073-drive-health-kill-switch.md) — the v0 kill-switch this amends (decision 3).
+- [`ADR-070`](ADR-070-tier1-drive-loop.md) / [`ADR-071`](ADR-071-launch-drive-integration.md) — the drive loop + launch enforcement point.

package/docs/decisions/ADR-075-workspace-gui-drive.md

@@ -0,0 +1,83 @@
+---
+adr: 075
+status: accepted
+date: 2026-06-08
+decision: workspace-gui-drive
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-075 — WorkspacePage drive integration (GUI v0)
+
+## Status
+
+**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
+gpt-4o, design mode, 2026-06-08) — both members converged firmly on the minimal
+surface. Makes the drive backend (ADR-069..074) usable from the GUI: the
+employee fills a task's inputs, runs it, and sees the host's turn — the
+"external-proof" payoff of the phase.
+
+## Context
+
+`src/ui/pages/WorkspacePage.tsx` (Preact + signals) had a "Start session" button
+that POSTed `/launch {role, task}` with **no inputs** and showed a banner — so
+every real-task launch hit the backend's render-error path. The GUI never
+collected inputs, never showed the driven turn, never surfaced drive health.
+
+## Decision
+
+| # | Question | Verdict | Rationale |
+|---|---|---|---|
+| 1 | Input collection | **Inline expander form** under the task — one field per declared input, required marked, `shape` as placeholder. | Least chrome; fits the existing task list. A modal / rail is more surface for no v0 benefit. |
+| 2 | Input-spec source | **Inline the spec in `GET /roles/:role/tasks`** (each task gains `inputs` + `skill_hint`); **no** dedicated inspect endpoint. | A dedicated lazy endpoint blocks the form on an RTT and adds a second failure mode; the per-task spec is <500 bytes. Parsed in Node (prompts are plaintext) for display; render/drive stays Python-authoritative. |
+| 3 | Result display | Driven turn → assistant **text** inline, **collapsed behind "Show full" past 2000 chars** (+ model/token meta). Each non-driven outcome → a distinct banner. | A 4k-token turn would break the chrome — the collapse is a day-1 guardrail, not post-v0 polish. |
+| 4 | Drive-health UI | **Defer a dedicated health panel.** Reflect `host_killed` / `recovered` from the launch response in the banner only. | `GET /drive-health` exists (ADR-073) for a later panel; a health dashboard is not the v0 critical path. |
+| 5 | Host selection | **Hard-code `host: 'claude-code'`** for v0; no host picker. | The v0 goal is validating the drive flow end-to-end with one host; a picker is UX debt (host ids ≠ model names) + an N×M test matrix for an unrequested feature. |
+
+**Shape-mismatch safety (council blocker check):** the renderer stringifies any
+input value (`str(val)`), so a wrong-typed input never 500s — only a
+missing-required input returns the structured `render-error` the banner shows.
+
+## Surface
+
+- `GET /roles/:role/tasks` now returns, per task, `inputs: [{name, required,
+  shape}]` + `skill_hint` (read-only display data).
+- `WorkspacePage`: selecting a role fetches tasks-with-specs; "Start session"
+  expands the inline `TaskForm`; "Run task" POSTs `/launch {role, task, inputs,
+  host: 'claude-code'}`; `TurnResult` renders the driven turn (collapsible);
+  `bannerFor()` maps every outcome (driven / recovered / host-killed /
+  render-error / no-prompt / handoff) to one banner.
+
+## Consequences
+
+- The full render → drive → turn path is now exercisable by an employee in the
+  browser — the phase's external-proof goal.
+- The tasks endpoint stays one round-trip; no new endpoint, no subprocess
+  fan-out (Node parses the plaintext prompt frontmatter for the display spec).
+- Multi-host selection and a drive-health panel are deferred with the
+  `host: 'claude-code'` default and the `host_killed`/`recovered` banner as the
+  forward hooks.
+
+## Alternatives considered
+
+- **Dedicated `/prompts/:name` inspect endpoint** — rejected: RTT block on form
+  open + a second failure mode; inlining is trivial payload.
+- **Host picker in v0** — rejected (both council members): speculative,
+  UX-confusing (host ids), and an N×M test matrix before any user has asked.
+- **Render the turn raw with no collapse** — rejected: a long turn breaks the
+  layout; the char-collapse is a day-1 guardrail.
+- **Drive-health panel now** — deferred: not the v0 critical path; the endpoint
+  already exists for a later pass.
+
+## Deferred to v1 (debt)
+
+A host picker (claude-code / codex / gemini / inbox), a drive-health panel fed
+by `GET /drive-health`, streaming turn output (v0 is single-turn), and a richer
+input-validation surface (typed fields beyond textarea + `shape` hints).
+
+## References
+
+- [`ADR-069`](ADR-069-prompt-renderer.md) / [`ADR-071`](ADR-071-launch-drive-integration.md) / [`ADR-073`](ADR-073-drive-health-kill-switch.md) / [`ADR-074`](ADR-074-drive-kill-switch-auto-recovery.md) — the drive backend this surfaces.
+- [`daily-workspace`](../contracts/daily-workspace.md) — the workspace surface contract.

package/docs/decisions/ADR-076-workspace-multi-turn.md

@@ -0,0 +1,92 @@
+---
+adr: 076
+status: accepted
+date: 2026-06-09
+decision: workspace-multi-turn
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-076 — Workspace multi-turn = conversation continuation (v0)
+
+## Status
+
+**Accepted** · 2026-06-09. Design converged via AI-council (claude-sonnet-4-5 +
+gpt-4o, design mode, 2026-06-08) — both members converged firmly on **Reading B
+(conversation continuation)** over Reading A (agentic tool-execution loop).
+Resolves the ADR-070 "multi-turn + tool execution" debt by scoping it correctly.
+
+## Context
+
+The ADR-070 debt was labelled "multi-turn + tool execution," which conflates two
+very different features. The council's framing decision:
+
+- **Reading A — agentic tool-execution loop at our layer.** Parse tool-call
+  requests from the host envelope, *we* execute them, feed results back. This is
+  **largely redundant** — `claude -p` / `codex exec` / `gemini -p` each run their
+  own agent loop + tool execution internally and return the *final* result. It
+  also makes **us** execute model-requested actions — a heavy security surface
+  (`security-sensitive-stop`: threat-model + allowlist + sandbox) for little
+  gain over what the host already does.
+- **Reading B — conversation continuation.** Every launch today is a *fresh*
+  single-turn session with no way to send a **follow-up** to the *same* host
+  session. We reuse the host session id (captured on `host.turn`) to continue
+  (`claude --resume`, `codex exec resume`, `gemini --resume`). The host keeps
+  running its own tools internally each turn; we add no execution surface.
+
+**Decision: Reading B.** It is the real, non-redundant gap and is far
+lower-risk. Reading A is deferred indefinitely (redundant with the host loop).
+
+## Decision (Reading B)
+
+| # | Question | Verdict |
+|---|---|---|
+| 1 | Surface | Dedicated **`POST /workspace/sessions/:id/continue {prompt}`**. |
+| 2 | Per-host resume | `build_resume_args(session_id, prompt)` + `supports_resume` per `HOST_CONFIGS`. All three Tier-1 hosts expose a documented non-interactive resume (verified): claude `--resume <id> -p`, codex `exec resume <id> --json <prompt>`, gemini `--resume <id> -p`. |
+| 3 | session-id source | The **most recent `host.turn`** record's `session_id` (the session log is canonical). **No host turn with a session_id → HTTP 409** ("run at least one turn first"). |
+| 4 | Health interaction | Continuation is a drive → same `gate()` + `recordDriveHealth` as a launch (kill-switch applies). |
+| 5 | First PR | Mechanics only — `build_resume_args` + the session-id lookup + `/continue`. The GUI "Follow up" affordance is a later PR. |
+
+**Failure handling:** a resume drive failure is recorded as `host.error` and
+returned `{driven:false, error_kind}` (same shape as a launch). A host-session-
+expired 410 mapping (distinct from a generic failure) needs per-host stderr
+parsing → deferred to v1. The append-only session log has no per-session
+"status", so there is no "stuck in_progress" state to recover.
+
+## Consequences
+
+- A follow-up turn continues the *same* host conversation (the host carries its
+  own context + ran its own tools on turn 1) — no tool-execution surface at our
+  layer, no threat-model gate tripped.
+- `/continue` reuses the launch drive machinery (`driveHostTurn` gained an
+  optional `resumeSessionId`), so the kill-switch, health recording, and
+  encrypted `host.turn` append all apply unchanged.
+- The 409 guard makes "continue a session that never drove" fail loud.
+
+## Alternatives considered
+
+- **Reading A (agentic tool-exec loop)** — rejected: redundant with the host
+  CLI's own loop + a heavy security surface for no gain.
+- **Fold continuation into a generalised launch** — rejected: a dedicated
+  session-keyed endpoint is clearer and avoids overloading launch's contract.
+- **A separate session-id index** — rejected: the session log already records
+  it on `host.turn`; a second source would drift.
+- **Concurrency lock on `/continue`** — deferred: the drive infra is already
+  sequential-launch-assumed; concurrent continuation is a later hardening
+  concern, documented not solved.
+
+## Deferred to v1 (debt)
+
+A 410 "host session expired" mapping (per-host stderr detection), a session-
+level concurrency lock, and the GUI "Follow up" affordance. Reading A (agentic
+tool execution at our layer) remains deferred indefinitely — redundant with the
+host loop.
+
+## References
+
+- [`ADR-070`](ADR-070-tier1-drive-loop.md) — the drive loop + the "multi-turn" debt this scopes.
+- [`ADR-071`](ADR-071-launch-drive-integration.md) / [`ADR-073`](ADR-073-drive-health-kill-switch.md) — the launch drive + kill-switch `/continue` reuses.
+- [`ADR-023`](ADR-023-host-agent-protocol.md) — the three Tier-1 hosts + their CLIs.
+- [`security-sensitive-stop`](../../dist/agent-src/rules/security-sensitive-stop.md) — why Reading A's execution surface was avoided.

package/docs/decisions/ADR-077-workspace-followup-gui.md

@@ -0,0 +1,70 @@
+---
+adr: 077
+status: accepted
+date: 2026-06-09
+decision: workspace-followup-gui
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-077 — WorkspacePage follow-up affordance (GUI for /continue)
+
+## Status
+
+**Accepted** · 2026-06-09. Closes the GUI debt [`ADR-076`](ADR-076-workspace-multi-turn.md)
+explicitly deferred ("the GUI 'Follow up' affordance"). A small, mechanical
+reuse of the ADR-075 GUI patterns over the merged `/continue` endpoint — no
+council needed (no design fork; the only target is the active session).
+
+## Context
+
+ADR-076 shipped `POST /sessions/:id/continue` (resume the same host session) but
+left it unsurfaced — the WorkspacePage could drive a first turn (ADR-075) but
+not send a follow-up. This wires that.
+
+## Decision
+
+- After a **driven** turn, `TurnResult` shows a **"Follow up"** textarea +
+  "Send follow-up" button. Submit calls `continueTurn(launchResult.id, prompt)`
+  → `POST /sessions/:id/continue {prompt}` → replaces the displayed turn with
+  the continuation (reusing `TurnResult` + `bannerFor`).
+- **Target = the active session** (`launchResult.id`). v0 does not add a
+  session-strip "continue any past session" affordance — the natural flow is
+  launch → see turn → follow up. Picking an arbitrary historical session to
+  resume is deferred.
+- The box appears **only when a turn has driven** (`launchResult.driven`); a
+  hand-off / render-error / host-killed outcome shows no follow-up (there is no
+  host session to continue) — matching the `/continue` 409 guard.
+- `followupText` resets on a new launch (a fresh launch starts a fresh
+  conversation); it clears on a landed continuation, and is **kept** on a
+  failed one so the user can retry.
+
+## Consequences
+
+- The end-to-end multi-turn flow is now visible: launch → turn → follow-up →
+  turn, all in the same host session, with the kill-switch + health applying to
+  every turn (server-side, ADR-073/076).
+- Pure additive reuse — no new endpoint, no server change; `bannerFor` /
+  `TurnResult` already handle the continuation response shape (identical to a
+  launch result).
+
+## Alternatives considered
+
+- **Continue any session from the strip** — deferred: the active-session flow
+  is the v0 critical path; arbitrary-session resume needs a session-detail view
+  first.
+- **A dedicated continuation ADR section in ADR-076** — chose a thin ADR-077
+  instead so the deferred-debt closure has its own audit entry.
+
+## Deferred to v1 (debt)
+
+Continue an arbitrary past session from the session strip; a per-turn
+conversation thread view (today the latest turn replaces the prior in the
+result pane — the full thread lives in the session JSONL).
+
+## References
+
+- [`ADR-076`](ADR-076-workspace-multi-turn.md) — the `/continue` endpoint this surfaces (and the debt it closes).
+- [`ADR-075`](ADR-075-workspace-gui-drive.md) — the GUI drive patterns (`TaskForm` / `TurnResult` / `bannerFor`) reused here.

package/docs/decisions/ADR-078-drive-health-panel.md

@@ -0,0 +1,70 @@
+---
+adr: 078
+status: accepted
+date: 2026-06-09
+decision: drive-health-panel
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-078 — WorkspacePage drive-health panel (read-only)
+
+## Status
+
+**Accepted** · 2026-06-09. Closes the GUI debt deferred by
+[`ADR-073`](ADR-073-drive-health-kill-switch.md) ("a dedicated health panel")
+and [`ADR-075`](ADR-075-workspace-gui-drive.md) (deferred the drive-health UI).
+Small mechanical reuse — consumes the existing `GET /drive-health` (ADR-073);
+no server change, no council (read-only display of existing data).
+
+## Context
+
+The kill-switch (ADR-073/074) trips a host to inbox-only after repeated drive
+failures and auto-recovers it on a cooldown probe. `GET /drive-health` exposes
+that state, but the GUI only reflected `host_killed` / `recovered` transiently
+in a launch banner — an operator had no standing view of *which* host is paused
+and *why*.
+
+## Decision
+
+- A read-only **Host health** panel in the workspace rail, fed by the existing
+  `GET /drive-health` (fetched in `load()`, **non-critical**: a failed health
+  fetch never blocks the page — it falls back to an empty snapshot).
+- Surfaces **only unhealthy hosts** (killed, or with a non-zero failure
+  streak); the common all-healthy case shows a one-line "All hosts healthy."
+- Per host: state (`paused — auto-recovering` for an auto-trip, `paused
+  (manual)` for a manual kill, `degraded` for a streak without a trip), the
+  failure streak, and the last error kind.
+- **No reset action in v0** — reset stays a CLI op (`workspace_drive_health.py
+  reset`); auto-cooldown (ADR-074) handles the common recovery, so a GUI reset
+  button (which would need a new state-mutating endpoint) is deferred.
+
+## Consequences
+
+- An operator can see at a glance why a host isn't driving and whether it is
+  auto-recovering — the observability the kill-switch councils asked for.
+- Purely additive + non-critical: no server change, and a health-endpoint
+  failure degrades to "All hosts healthy" rather than breaking the workspace.
+
+## Alternatives considered
+
+- **A reset button in the panel** — deferred: needs a new POST endpoint
+  (state mutation); auto-recovery covers the common case, so v0 stays
+  read-only.
+- **Always list every host (including healthy)** — rejected: noise; the panel
+  earns its space only when something is wrong.
+- **Poll `/drive-health` on an interval** — deferred: a load-time snapshot +
+  the launch banner's live `host_killed`/`recovered` cover v0; live polling is
+  a later refinement.
+
+## Deferred to v1 (debt)
+
+A GUI reset button (+ its endpoint), live polling / refresh, and a full
+per-host history view (totals, trip count over time).
+
+## References
+
+- [`ADR-073`](ADR-073-drive-health-kill-switch.md) / [`ADR-074`](ADR-074-drive-kill-switch-auto-recovery.md) — the kill-switch + `GET /drive-health` this surfaces.
+- [`ADR-075`](ADR-075-workspace-gui-drive.md) — the GUI rail + patterns reused.

package/docs/decisions/ADR-079-workspace-host-picker.md

@@ -0,0 +1,81 @@
+---
+adr: 079
+status: accepted
+date: 2026-06-09
+decision: workspace-host-picker
+supersedes: —
+superseded_by: —
+phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
+type: structural
+---
+
+# ADR-079 — WorkspacePage host picker (v1)
+
+## Status
+
+**Accepted** · 2026-06-09. Design + a focused tie-break converged via AI-council
+(claude-sonnet-4-5 + gpt-4o, design mode, 2026-06-09). **Reverses the v0
+deferral** in [`ADR-075`](ADR-075-workspace-gui-drive.md) (which hard-coded
+`host: 'claude-code'` "until real usage / if users demand it"): the backend now
+drives all three Tier-1 hosts (ADR-072), so surfacing the choice is the
+anticipated v1.
+
+## Context
+
+ADR-075 deferred a host picker citing "host ids ≠ model names (confusing), an
+N×M test matrix, an unrequested feature." With codex + gemini drive configs
+merged, the picker is the natural v1. This ADR confirms the reversal and
+addresses the UX concern the deferral raised.
+
+## Decision
+
+| # | Question | Verdict | Rationale |
+|---|---|---|---|
+| 1 | Labels | **Friendly label + id**: `Claude Code (claude-code)`, `Codex (codex)`, `Gemini (gemini)`. | Resolves the "ids are confusing" concern without hiding the id the backend uses. |
+| 2 | Placement | **Global header `<select>`** (one host per session) — **tie-break decision**. | Round 2 split (global vs per-task); the tie-break converged on global: v0 was already session-global, zero data on per-task switching, per-task + sessionStorage has the *same* stickiness with more UI repetition. |
+| 3 | Persistence | Default `claude-code`; persist in **`sessionStorage`** (per-session), not `localStorage`. | Cross-session stickiness without usage data is speculative ("spooky action"); session scope matches the picker's session-global model. |
+| 4 | Options | The **three Tier-1 hosts** only. | The inbox is already the automatic degrade when a CLI is absent — a manual inbox option is redundant chrome. |
+| 5 | Availability | A new **`GET /workspace/hosts`** returns each Tier-1 host's `cli_present`; the picker **disables an uninstalled host** with a "not installed" note. **Fail open** — no availability data → all hosts selectable. | The council's hardest hit: a "dumb" picker lets a user pick an absent host and waste a launch that only degrades to the inbox. The probe is side-effect-free (`shutil.which`), no API spend. |
+
+No feature flag: the picker **defaults to `claude-code`**, exactly v0's
+behaviour, so the safe fallback is the default itself.
+
+## Surface
+
+- `GET /api/v1/workspace/hosts` → `{ hosts: [{ id, cli_present, effective_tier }] }`
+  (Tier-1 only, via `workspace_hosts.py list`). Fail-open to `[]`.
+- `WorkspacePage`: a header `HostPicker` `<select>` (friendly labels, absent
+  hosts disabled) → `setSelectedHost` persists to `sessionStorage`; `launch()`
+  sends `selectedHost`. Continuation still resumes the session's recorded host
+  (unchanged).
+
+## Consequences
+
+- An employee can run a task on Codex or Gemini, not just Claude Code, and sees
+  which hosts are actually installed before picking.
+- Availability + host fetches are **non-critical** in `load()` — a failure
+  degrades to "all hosts enabled" / empty, never blocks the page.
+- Continuation (ADR-076) is unaffected — it always resumes the host recorded on
+  the session's turns, regardless of the current picker value.
+
+## Alternatives considered
+
+- **Per-task picker** — rejected at tie-break: same stickiness as the global
+  select with more per-launch chrome; no evidence for per-task host variance.
+- **localStorage persistence** — rejected: cross-session stickiness is
+  speculative without usage data.
+- **Manual "inbox hand-off" option** — rejected: redundant with the automatic
+  absent-CLI degrade.
+- **Dumb picker (no availability)** — rejected: wastes a launch on an absent
+  host; the cheap `which` probe avoids the first-run friction.
+
+## Deferred to v1+ (debt)
+
+Live availability polling (re-probe without a reload), a model-tier hint per
+host, and per-task host override (only if usage shows real per-task variance).
+
+## References
+
+- [`ADR-075`](ADR-075-workspace-gui-drive.md) — the v0 deferral this reverses.
+- [`ADR-072`](ADR-072-codex-gemini-drive-configs.md) — the codex/gemini drive configs that make the choice meaningful.
+- [`ADR-068`](ADR-068-host-tier-detection.md) — `workspace_hosts.py` detection the `/hosts` endpoint reuses.