@event4u/agent-config 9.28.0 → 9.29.0

package/src/scripts/team_review_gate_hook.ts

@@ -3,14 +3,36 @@
  * Team Review-Gate governance — `stop` concern (road-to-team-mode Phase 4).
  *
  * Minimal call-site for `src/scripts/ai_team/review_gate.ts`. On Stop it
- * reads the dispatcher envelope, and — ONLY when `ai_team.enabled` AND
- * `ai_team.review_gate.managed` are true — locates the newest stop-gate
- * review job the codex plugin persisted for this session, parses its
- * first-line ALLOW/BLOCK contract, applies the consecutive-BLOCK counter,
- * and prints the circuit-breaker notice (exactly once per trip) to stdout
- * for the dispatch layer to render. With `managed: false` (default) the
- * hook exits 0 without touching anything — byte-identical pre-Phase-4
- * Stop behavior.
+ * reads the dispatcher envelope, and — ONLY when `ai_team.review_gate.managed`
+ * is true — locates the newest stop-gate review job the codex plugin
+ * persisted for this session, parses its first-line ALLOW/BLOCK contract,
+ * applies the consecutive-BLOCK counter, and prints the circuit-breaker
+ * notice (exactly once per trip) to stdout for the dispatch layer to
+ * render. With `managed: false` (default) the hook exits 0 without
+ * touching anything — byte-identical pre-Phase-4 Stop behavior.
+ *
+ * `ai_team.enabled` was DELETED (road-to-always-on-orchestration Phase 1,
+ * Step 1.3) — `managed` was previously double-gated behind it, but the two
+ * keys govern independent things: `managed` governs the codex PLUGIN's own
+ * Stop-hook loop (upstream's mechanism, which does not depend on our codex
+ * CLI availability), while `/team`'s own availability is a separate,
+ * CLI-resolved fact (`src/scripts/ai_team/availability.ts`) that the
+ * conversational `/team` wrappers check, not this passive Stop hook. So the
+ * two keys are decoupled: `managed` stands alone.
+ *
+ * DELIBERATELY NOT GATED ON `emergency.orchestration_halt` (independent
+ * review, road-to-always-on-orchestration): unlike `/team`'s own
+ * conversational surfaces (`assert_delegate_allowed` / `run_team_review` in
+ * `ai_team/team_dispatch.ts`, both of which check `isOrchestrationHalted`
+ * before doing anything), this hook never reads that switch. This is
+ * intentional, not an oversight — `managed` governs the UPSTREAM codex
+ * plugin's OWN Stop-hook loop, a third-party mechanism this hook merely
+ * observes and reports on (parsing an already-persisted job record); it
+ * never itself dispatches, spends, or calls a provider. The always-on-
+ * orchestration incident switch exists to pause OUR dispatch surfaces —
+ * there is no dispatch here to pause. Tripping the halt does not, and
+ * should not, silence this hook's circuit-breaker notice about the
+ * plugin's own loop.
  *
  * Composition point (wired): registered as the `team-review-gate` concern
  * in `src/scripts/hook_manifest.yaml` on the claude `stop` slot, after
@@ -56,7 +78,7 @@ export function main(): number {
         // owns reporting it. Defaults = managed off = strict no-op.
         config = AI_TEAM_DEFAULTS;
     }
-    if (!config.enabled || !config.review_gate.managed) {
+    if (!config.review_gate.managed) {
         return 0;
     }
 

package/src/server/schemas/settings.ts

@@ -331,18 +331,9 @@ export const settingsSchema = z.object({
         }).default({}),
     }).default({}),
     subagents: z.object({
-        enabled: z.boolean().default(true).describe(
-            'Global master switch for the subagent layer. true (default) = available; false = fully disabled (the canonical kill-switch — no auto-dispatch, no routing, everything runs in-session).',
-        ),
-        auto: z.enum(['off', 'ask', 'on']).default('on').describe(
-            'Automatic-dispatch mode. off = subagents only via explicit command. ask = classify the task and ask once before dispatching. on = auto-dispatch delegable tasks (surface the choice in one line). Shipped default is on on subagent-capable hosts (flipped from ask 2026-07-09, ADR-117), off elsewhere; no-op where the host has no subagent primitive.',
-        ),
         downshift: z.boolean().default(true).describe(
             'Route delegable sub-tasks to the lowest-capable model tier (cost + speed via model downshift). false = every subagent runs on the session tier.',
         ),
-        budget_routing: z.enum(['ask', 'auto', 'off']).default('ask').describe(
-            'Budget-aware cheap-request delegation (docs/contracts/budget-routing.md): pick the cheapest classifier-adequate tier WITH available budget (cost.budgets.per_tier); cheap exhausted but strong funded → strong tier; all exhausted → session model + notice. Work is never blocked to save money; the session model is never switched (delegation with a model override). ask = confirm the first budget-motivated downshift per session (default). auto = apply silently with telemetry. off = today\'s behavior (single-flip rollback). Distinct from downshift: that is the quality/cost knob, this is the resource-availability gate.',
-        ),
         quota_arbitrage: z.boolean().default(true).describe(
             'Prefer a separate quota-pool model for delegable sub-tasks where the host manifest reports one. Optional bonus only — identical behaviour (minus the quota win) where unsupported. Never load-bearing.',
         ),
@@ -353,9 +344,6 @@ export const settingsSchema = z.object({
         }).default({}).describe(
             'Per-tier model map for downshift routing. Each empty value uses the tier runtime default (no vendor model baked in).',
         ),
-        host_capabilities: z.object({}).passthrough().default({}).describe(
-            'Optional override of the host-capability manifest (subagent_spawn / parallel_spawn / status_polling / separate_quota_pool). Any field set wins; omitted fields fall back to the all-false safe default. Empty = the agent resolves the manifest from host knowledge.',
-        ),
         implementer_model: z.string().default('').describe(
             'Override the model the orchestrator dispatches to subagents that write code (e.g. claude-sonnet-4, gpt-5). Empty (default) = inherit the session\'s primary model — cheapest and usually right.',
         ),
@@ -375,14 +363,11 @@ export const settingsSchema = z.object({
         ),
     }),
     ai_team: z.object({
-        enabled: z.boolean().default(false).describe(
-            'Master switch for the /team cross-model review family (docs/contracts/ai-team-config.md). false (default) = commands are never suggested and every invocation refuses with an enable pointer. true = the family is live; individual gates (allow_delegate) still apply.',
-        ),
         model: z.string().default('auto').describe(
             "Model handed to the codex CLI. 'auto' (default) = pass no --model flag so the CLI's own default applies — tracks the subscription's current strongest model instead of pinning a stale ID. Any other value passes through verbatim as `--model <value>`.",
         ),
         allow_delegate: z.boolean().default(false).describe(
-            'Second opt-in for the only wrapper that delegates write access (/team:delegate). false (default) = delegate refuses even when ai_team.enabled is true. Both keys must be true before delegation is reachable.',
+            'Second opt-in for the only wrapper that delegates write access (/team:delegate). false (default) = delegate refuses even when /team itself is available. Availability (codex CLI installed + authenticated) is necessary but not sufficient — this key must ALSO be true before delegation is reachable.',
         ),
         max_calls_per_day: z.number().int().min(0).default(50).describe(
             'Per-day cap on team calls, read against the EXISTING cli_call_budget openai bucket (~/.event4u/agent-config/cli-calls.json, daily UTC reset) — one subscription, one counter, never a parallel count. 0 = block all team calls.',
@@ -398,7 +383,15 @@ export const settingsSchema = z.object({
                 'Circuit-breaker bound: after this many CONSECUTIVE BLOCK verdicts in one session, a visible notice is injected exactly once and the managed layer stops re-blocking — the user decides, never an infinite Claude↔Codex loop. An ALLOW verdict resets the counter. Positive integer.',
             ),
         }).default({ managed: false, max_consecutive_blocks: 3 }),
-    }).default({ enabled: false, model: 'auto', allow_delegate: false, max_calls_per_day: 50, suppress_setup_hint: false, review_gate: { managed: false, max_consecutive_blocks: 3 } }),
+    }).default({ model: 'auto', allow_delegate: false, max_calls_per_day: 50, suppress_setup_hint: false, review_gate: { managed: false, max_consecutive_blocks: 3 } }),
+    emergency: z.object({
+        orchestration_halt: z.boolean().default(false).describe(
+            'The one audited incident switch over the always-on orchestration stack (subagents, council, team). NOT an activation gate: false (default) = the stack runs normally. true = halted; arming requires no ceremony. Disarming (returning to false) requires orchestration_halt_justification to be a non-empty string. Both transitions emit one telemetry line.',
+        ),
+        orchestration_halt_justification: z.string().default('').describe(
+            'Required non-empty before orchestration_halt may return to false. Ignored while arming the halt.',
+        ),
+    }).default({ orchestration_halt: false, orchestration_halt_justification: '' }),
     onboarding: z.object({
         onboarded: z.boolean().default(false).describe(
             'Set to true once the developer has completed `agent-config setup`. The onboarding-gate rule blocks the first turn of every chat until this is true. Toggle back to false to re-trigger the wizard.',

package/src/shared/settingsCarveOut.ts

@@ -57,16 +57,6 @@ export const SETTINGS_CARVE_OUT: readonly CarveOutKey[] = [
             'Same upgrade contract as projection.mode, and the failure is louder: '
             + 'an absent list widens the projection instead of narrowing it.',
     },
-    {
-        key: 'subagents.auto',
-        reader: 'src/scripts/routing_doctor.ts:206',
-        absentResolvesTo: 'ask',
-        reason:
-            'The reader falls back to `ask` while the template ships `on`. Carved out '
-            + 'rather than fixed at the reader because the doctor reports what the '
-            + 'RESOLVED configuration is; changing its fallback would make the report '
-            + 'disagree with what the other readers actually do.',
-    },
     {
         key: 'discipline_profile',
         reader: 'work_engine/_lib/agent_settings.ts:1263',

package/src/shared/settingsClasses.ts

@@ -130,11 +130,12 @@ export function isConservativeDefault(value: unknown): boolean {
 /**
  * Dotted leaf paths of a parsed settings tree.
  *
- * A leaf is anything that is not a NON-EMPTY map. An empty map is a real
- * configurable value with a real default (`subagents.host_capabilities: {}`),
- * so it is a leaf — one more than the template↔schema parity walk produces.
- * That divergence is deliberate: a key the parity walk skips is exactly the
- * key that would otherwise reach the writer with no class.
+ * A leaf is anything that is not a NON-EMPTY map. An empty map (e.g. an
+ * optional override object with every field left unset) is a real
+ * configurable value with a real default, so it is a leaf — one more than
+ * the template↔schema parity walk produces. That divergence is deliberate: a
+ * key the parity walk skips is exactly the key that would otherwise reach
+ * the writer with no class.
  */
 export function settingsLeafPaths(value: unknown, prefix = ''): string[] {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
@@ -164,10 +165,11 @@ export function getSettingsLeaf(root: unknown, dotted: string): unknown {
  *
  * An exact row wins. Failing that, the longest classified prefix does: a
  * class-C key whose value is a MAP has children that never appear in a flattened
- * diff under the key's own name, so `subagents.host_capabilities.subagent_spawn`
- * must inherit the C on `subagents.host_capabilities` rather than read as
- * unclassified. Returns `undefined` when nothing on the path is classified —
- * and every caller treats that as guarded, not as free.
+ * diff under the key's own name (e.g. a hypothetical `foo.overrides: {}` with a
+ * class-C row on `foo.overrides` itself), so `foo.overrides.some_field` must
+ * inherit the C on `foo.overrides` rather than read as unclassified. Returns
+ * `undefined` when nothing on the path is classified — and every caller
+ * treats that as guarded, not as free.
  */
 export function classOfPath(
     index: ReadonlyMap<string, SettingsClass>,