@evoclock/pi-agentic-driver 0.9.1 → 0.9.2

package/.agentic-driver/router.defaults.json

@@ -0,0 +1,64 @@
+{
+  "schema": "agentic-driver.router-config.v1",
+  "revision": 1,
+  "endpoints": {
+    "local-default": {
+      "url": "http://127.0.0.1:8080",
+      "kind": "llama-server"
+    }
+  },
+  "seats": [
+    {
+      "schema": "agentic-driver.seat.v1",
+      "seatId": "local-default",
+      "kind": "local",
+      "provider": "llama-server",
+      "accountId": null,
+      "endpointRef": "local-default",
+      "model": "replace-with-installed-model",
+      "capabilities": ["implement", "review"],
+      "containmentTier": "none",
+      "maxConcurrency": 1,
+      "costClass": "free",
+      "quotaCollector": null,
+      "clusterMembership": null,
+      "enabled": false,
+      "deprecated": null
+    }
+  ],
+  "models": {
+    "replace-with-installed-model": {
+      "aliases": [],
+      "contextWindow": 32768,
+      "capabilities": ["implement", "review"]
+    }
+  },
+  "collectors": {},
+  "eligibility": {
+    "rules": [],
+    "reserve": {
+      "floorPercent": 40,
+      "scope": "account-window",
+      "coldStartFraction": 0.25,
+      "estimateSamples": 20,
+      "estimateMinSamples": 5,
+      "estimateOutlierSigma": 3,
+      "ownerInteractiveOverride": false
+    }
+  },
+  "preferences": {
+    "order": [{ "seatId": "local-default" }],
+    "costPolicy": "free-first"
+  },
+  "ranking": {
+    "enabled": false,
+    "janusUrl": "http://127.0.0.1:7431",
+    "maxCandidates": 8,
+    "fallback": "preference-order"
+  },
+  "localHealth": {
+    "probeSeconds": 60,
+    "warmStateTracking": true
+  },
+  "secrets": {}
+}

package/LICENSE

@@ -723,14 +723,17 @@ on the Software.
                           COMMERCIAL LICENCE OPTION
 ================================================================================
 
-A commercial licence that waives the obligations of the GNU Affero
-General Public License (including the network-use source-disclosure
-obligation of Section 13 and the additional terms of Section 7(b)
-above) is available for users who cannot or do not wish to comply
-with the terms of the GNU Affero General Public License.
-
-The commercial licence is intended for for-profit entities and any
-use in a paid product or service. Contact the author for details.
+Commercial use, modification, and distribution are permitted under
+the GNU Affero General Public License when all AGPL obligations and
+the additional terms of Section 7(b) above are followed. This includes
+the network-use source-disclosure obligation of Section 13 and the
+required preservation of attribution.
+
+A separate commercial licence is available for organisations that
+require proprietary modifications, do not wish to disclose covered
+source as required by the AGPL, need alternative attribution terms, or
+otherwise cannot or do not wish to comply with the AGPL. Contact the
+author for details.
 
 When published, the commercial licence template will be available at
 COMMERCIAL.md in this repository.

package/README.md

@@ -1,4 +1,4 @@
-# pi-agentic-driver v0.9.0
+# pi-agentic-driver
 
 <p align="center">
   <img src="assets/Yamagane-origami.png" alt="pi-agentic-driver, Yamagane origami mark" width="140"/>
@@ -7,7 +7,6 @@
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-AGPL%20v3-blue?style=flat" alt="License: AGPL v3"/></a>
   <a href="https://www.npmjs.com/package/@evoclock/pi-agentic-driver"><img src="https://img.shields.io/npm/v/@evoclock/pi-agentic-driver?style=flat" alt="npm version"/></a>
-  <img src="https://img.shields.io/badge/version-0.9.0-blue?style=flat" alt="Version 0.9.0"/>
   <img src="https://img.shields.io/badge/status-active%20development%20%26%20testing-orange?style=flat" alt="Status"/>
   <img src="https://img.shields.io/badge/JavaScript-F7DF1E?style=flat&logo=javascript&logoColor=black" alt="JavaScript"/>
   <img src="https://img.shields.io/badge/TypeScript-3178C6?style=flat&logo=typescript&logoColor=white" alt="TypeScript"/>
@@ -53,6 +52,7 @@ proofs for agentic workflows.
 | `agentic_kanban_board_write` | Adds cards to the board through the trusted writer, which records who authorized the work. | shipped |
 | `agentic_kanban_board_update` | Moves, closes, flags, edits, or removes cards on the board, always recording who authorized the change. | shipped |
 | `agentic_kanban_board_dispatch` | Claims an eligible board card for automated contained work and creates its assignment envelope. | shipped |
+| `agentic_kanban_pulse` | Checks for ready work and available capacity, then starts assignments under the board policy. | shipped |
 
 **Status: active development and testing.** Each extension ships only after
 it passes fixture-based acceptance, native tests, live-session checks, and
@@ -66,7 +66,7 @@ components are listed here for transparency and are not packaged.
 <details>
 <summary><strong>code-phage, advisory code review</strong> <em>(released, 0.1.1)</em></summary>
 
-`code_phage` reviews a proposed change against a stated goal before the agent
+The `code_phage` tool reviews a proposed change against a stated goal before the agent
 writes or commits code. Give it a goal, candidate files, accepted
 requirements, and test paths. It will:
 
@@ -109,8 +109,10 @@ only, not a runtime dependency).
 <details>
 <summary><strong>herdr-communication, controlled role communication</strong> <em>(released, 0.2.1)</em></summary>
 
-`agentic_herdr_communication` exchanges controlled, marked reports with
-configured Pi worker roles running under [Herdr](https://herdr.dev/) 0.8.2.
+The `agentic_herdr_communication` tool exchanges controlled, marked reports with
+configured Pi worker roles running under [Herdr](https://herdr.dev/) (validated
+against Herdr 0.9.1; the trust seam accepts the Homebrew-managed herdr binary
+across versions rather than pinning one).
 
 - **List and observe.** Worker roles are filtered to trusted repositories: a
   checked-in registry plus canonical-path validation. Unlisted or
@@ -133,7 +135,7 @@ configured Pi worker roles running under [Herdr](https://herdr.dev/) 0.8.2.
 <details>
 <summary><strong>herdr-lifecycle, role-labelled worker dispatch</strong> <em>(released, 0.2.1)</em></summary>
 
-`agentic_herdr_spawn_worker` turns one natural-language request into Herdr's
+The `agentic_herdr_spawn_worker` tool turns one natural-language request into Herdr's
 native lifecycle. Choose a placement (`right`, `below`, or `tab`), a safe role
 label, a model from the active Pi model roster, and a trusted repository. The
 extension:
@@ -165,7 +167,7 @@ for the wider task and model-routing workflow.
 <details>
 <summary><strong>herdr-dispatch, continuous worker journeys</strong> <em>(released, 0.5.0)</em></summary>
 
-`agentic_worker_dispatch` runs controlled worker journeys and observes worker
+The `agentic_worker_dispatch` tool runs controlled worker journeys and observes worker
 liveness. Two actions:
 
 - **pulse** reports whether a worker role is alive, its current state, and
@@ -192,7 +194,7 @@ silently, and return results as untrusted evidence.
 
 
 <details>
-<summary><strong>task board, planned and automated work you can see</strong> <em>(released, 0.9.0)</em></summary>
+<summary><strong>task board and Pulse, planned and automated work you can see</strong> <em>(released, 0.9.1)</em></summary>
 
 Keep planned work in canonical `TASKS.md`. You can read it directly or use
 the generated `board.md` view in Obsidian. Agents use the same canonical
@@ -216,10 +218,10 @@ For automated work, you set an explicit policy for the board. It defines:
 
 Without a valid policy, automated dispatch is refused.
 
-`agentic_kanban_board_dispatch` claims the highest-priority eligible card and
-creates a single-attempt assignment envelope. The envelope binds the card,
-repository, starting revision, assigned branch, allowed paths, stopping
-point, expiry, and interaction profile.
+The `agentic_kanban_board_dispatch` tool claims the highest-priority eligible card. It
+creates a single-attempt assignment envelope that binds the card, repository,
+starting revision, assigned branch, allowed paths, stopping point, expiry, and
+interaction profile.
 
 Blocked, altered, expired, reused, or unauthorized assignments fail closed.
 The journey validates the authenticated envelope before each consequential
@@ -232,10 +234,12 @@ Claims and envelopes are kept in authenticated state beside `TASKS.md`. The
 derived `board.md` view shows active claims but never becomes an authority
 source.
 
-`agentic_kanban_pulse` checks the board for ready work and available capacity.
-A check only reports which work is ready to run. It does not claim cards. Interactive host
-work needs explicit policy and one native confirmation for the batch. Automated
-work requires containment and never falls back to the host.
+The `agentic_kanban_pulse` tool checks the board for ready work and available capacity.
+A check only reports which work is ready to run. It does not claim cards.
+
+Interactive host work needs explicit policy and one native confirmation for
+the batch. Automated work requires containment and never falls back to the
+host.
 
 Coming next:
 
@@ -264,7 +268,7 @@ writer's voice.*
 <details>
 <summary><strong>AI;DR, writing review</strong> <em>(released, 0.4.2)</em></summary>
 
-`agentic_aidr` reviews the last assistant response, supplied prose, or a
+The `agentic_aidr` tool reviews the last assistant response, supplied prose, or a
 Markdown file. It checks four principles:
 
 - **Clarity.** Each sentence carries one useful idea.
@@ -304,8 +308,8 @@ QEMU/KVM virtual machine on a Linux host. The job cannot reach the host, the
 network, or anything else outside the machine. The system deletes the machine
 after the job ends.
 
-Isolation is off at the start of every session. You turn it on with
-`/agentic-isolation-enable` in the Pi TUI, and confirm. The model cannot run
+Isolation is off at the start of every session. Use the `/agentic-isolation-enable`
+command in the Pi TUI, and confirm. The model cannot run
 that command. Every cutover run asks for its own confirmation too. Nothing is
 saved to settings, and headless sessions stay blocked.
 
@@ -532,10 +536,9 @@ acceptance with all prohibited effects absent.
 
 ### Portable repository contract
 
-`templates/AGENTS.md` is a starting contract you can copy into any repository
-that uses Pi agents. It asks for controlled tasks and realistic tests, and
-treats agent reports as untrusted evidence. It never overwrites an existing
-`AGENTS.md`; add your project rules below it.
+The `templates/AGENTS.md` file is a starting contract you can copy into any
+repository that uses Pi agents. It asks for controlled tasks and realistic tests, and
+treats agent reports as untrusted evidence. It never overwrites an existing `AGENTS.md`. Add your project rules below it.
 
 ## Install
 
@@ -545,24 +548,24 @@ From npm:
 pi install npm:@evoclock/pi-agentic-driver
 ```
 
-Or from Git at a pinned tag:
+Or from Git at the latest release tag (see the repo's tags for the current one; the npm badge above shows the live version):
 
 ```sh
-pi install git:github.com/evoclock/pi-agentic-driver@v0.9.0
+pi install git:github.com/evoclock/pi-agentic-driver@<latest-tag>
 ```
 
-Released extensions load standalone; neither requires the other.
+Released extensions load independently.
 
 ### Choose which extensions load
 
-A normal install loads all six extensions by default. You can load only the
+A normal install loads all packaged extensions by default. You can load only the
 extensions you want with the object form in your Pi settings:
 
 ```json
 {
   "packages": [
     {
-      "source": "npm:@evoclock/pi-agentic-driver@0.9.0",
+      "source": "npm:@evoclock/pi-agentic-driver",
       "extensions": [
         "extensions/aidr.ts",
         "extensions/code-phage.js"
@@ -572,12 +575,69 @@ extensions you want with the object form in your Pi settings:
 }
 ```
 
-The package also includes `herdr-communication.ts`, `herdr-lifecycle.ts`,
-`herdr-dispatch.ts`, and `linux-microvm.ts`. Use `pi config` to enable or
+The package includes the `herdr-communication.ts`, `herdr-lifecycle.ts`, and
+`herdr-dispatch.ts` extensions. It also includes `linux-microvm.ts`. Use `pi config` to enable or
 disable individual resources from an installed package. You are not required
 to use every extension.
 
+## Router configuration
+
+Board Pulse selects a route seat through the capacity/policy router. The
+router reads a closed configuration file and a local-first SQLite file for
+operational state (reservations, observations, route-decision audit).
+
+- **Repository defaults** ship at `.agentic-driver/router.defaults.json`. The
+template contains no accounts and one disabled placeholder seat, so it loads
+out of the box and schedules nothing until you enable a real seat.
+- **User profile (precedence over defaults):**
+`~/.config/agentic-driver/router/profile.json`, or the path in the
+`AGENTIC_DRIVER_ROUTER_PROFILE` environment variable. A profile section
+replaces the matching defaults section wholesale; the merged config must
+validate or the router refuses to produce decisions (fails closed).
+- **Operational state:** `~/.local/share/agentic-driver/router/state.db`, or
+`AGENTIC_DRIVER_ROUTER_DB`. This store is operational state only. The
+authenticated claims file and the board writer remain the only dispatch
+authority, and SQLite is repaired from them, never the reverse.
+- **Runtime requirement:** the operational store uses the built-in
+`node:sqlite` module. Node.js 22.5 or newer is required.
+
+### Tunable configuration values
+
+Every numeric policy in the router is a configuration key — never a
+constant in code. All keys are **required**. The repository defaults below
+are conservative starting values. Your profile overrides them. A missing key
+is a configuration validation failure: the router fails closed rather than
+guess. Changing a value participates in the configuration digest, so cached
+routing decisions computed under the old values no longer apply.
+
+| Section | Key | Default | What it controls |
+|---|---|---|---|
+| `eligibility.reserve` | `floorPercent` | 40 | Share of every quota window kept in reserve (per account, per window). Headroom for an unexpected burst and your next interactive session, without idling the account. |
+| `eligibility.reserve` | `scope` | `account-window` | How widely the reserve floor applies (per account per window at launch). |
+| `eligibility.reserve` | `coldStartFraction` | 0.25 | Consumption assumed for a seat with too little history: deliberately generous, so a mis-estimate fails eligibility instead of draining the account. |
+| `eligibility.reserve` | `estimateSamples` | 20 | How many recent dispatches the consumption estimate averages: enough to smooth outliers, quick enough to track a model change. |
+| `eligibility.reserve` | `estimateMinSamples` | 5 | Below this many observations the average is treated as noise and the cold-start value is used instead. |
+| `eligibility.reserve` | `estimateOutlierSigma` | 3 | Outlier cut for the estimate: one unusually slow dispatch cannot inflate the average, real tail latency is kept. |
+| `eligibility.reserve` | `ownerInteractiveOverride` | false | Whether your own interactive dispatches bypass the reserve rule (they do not, at launch). |
+| `ranking` | `janusUrl` | `http://127.0.0.1:8787` | The local janus evaluation service endpoint used for semantic ranking. |
+| `ranking` | `maxCandidates` | 8 | At most eight eligible seats are ranked per request; preference order trims first. |
+| `ranking` | `fallback` | `preference-order` | What happens when ranking is unavailable: dispatch falls back to your preference order and never blocks. |
+| `gate` | `threshold` | 0.9 | The dispatch gate's confidence threshold. A task is only dispatched when the evaluation clears it. Lower it only with evidence from your own audit log. |
+| `gate` | `timeoutMs` | 8000 | How long the gate waits for an evaluation. On timeout there is no verdict and dispatch is blocked (fail closed). |
+| `gate` | `requestBudgetTokens` | 30000 | Maximum size of a gate evaluation request. Normal evaluations use under a thousand tokens. |
+| seat record | `maxConcurrency` | 4 | How many workers one seat may run at once. The default suits a typical single machine or hosted seat. Tune it per seat: a cluster takes more, a constrained subscription endpoint may take less. |
+| automation policy | `maxConcurrent` | 4 | How many workers may run at once across all seats. The default is a conservative start. Tune it to the capacity you actually have, and raise it when you add seats or hardware. |
+
+Seats are named for infrastructure, not models: `dgx-spark-cluster`,
+`mac-studio`, `merge-gateway-worker`. The model is a mutable field on the
+seat, so changing models never renumbers your configuration. Each seat also
+carries `scopeStatements`: plain-language descriptions of what the seat is
+for. The dispatch gate reads them when judging whether a task fits.
+
 ## License
 
-AGPL-3.0-or-later with author-attribution additional terms (Section 7(b));
-see [LICENSE](LICENSE). A commercial licence is available on request.
+AGPL-3.0-only with author-attribution additional terms (Section 7(b));
+see [LICENSE](LICENSE). Commercial use, forks, and substantial modifications
+are permitted when all AGPL and attribution obligations are followed. A
+separate commercial licence is available for organisations requiring
+proprietary modifications or other terms incompatible with the AGPL.

package/extensions/attended-authority-guard.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 export default async function attendedAuthorityGuard(pi) {
   const module = await import(new URL("../scripts/enforcement/attended_authority_guard.js", import.meta.url).href);

package/extensions/code-phage.js

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import {
   analyzeCodePhage,

package/extensions/herdr-communication.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { statSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/extensions/herdr-dispatch.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 export default async function herdrDispatchPi(pi) {
   const dispatch = await import(new URL("../scripts/enforcement/herdr_async_dispatch_pi.js", import.meta.url).href);

package/extensions/herdr-lifecycle.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { registerHerdrLifecycleInterface } from "../scripts/enforcement/herdr_lifecycle_pi.js";
 

package/extensions/linux-microvm.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { registerLinuxMicroVMCutoverInterface, registerIsolationSwitchCommands, createIsolationSwitch } from "../scripts/enforcement/linux_microvm_cutover_pi.js";
 

package/extensions/pulse.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // Board Pulse provider extension. Registers the deterministic
 // agentic_kanban_pulse tool and owns the optional fixed-interval timer. The
@@ -16,6 +16,7 @@
 
 import { executeHerdrSpawnWorker } from "../scripts/enforcement/herdr_lifecycle_pi.js";
 import { resolveBoardPath, registerPulseTools, createPulseTimer, pulseTick, pulseWorkerSpawnSeam } from "../scripts/enforcement/pulse_scheduler_pi.js";
+import { prepareRouterRuntimeWithHealth, closeCachedRouterStores } from "../scripts/enforcement/router_runtime_pi.js";
 
 export default function pulsePi(pi) {
 
@@ -26,9 +27,31 @@ export default function pulsePi(pi) {
   // worker is ever started. No other creation path exists.
   const spawnWorker = pulseWorkerSpawnSeam({ executeHerdrSpawnWorker });
 
+  // The runtime is rebuilt per tool call and per automated tick (W3): a
+  // snapshot frozen at session setup would leave every subscription seat
+  // stale after the first observation expiry and freeze the prior-reservation
+  // term. The localHealth probe adapter (W2) is attached here, producing
+  // endpoint-keyed fresh health observations for local seats. `check`
+  // assembles the runtime read-only (W4): no store writes, no store creation.
+  const routerRuntimeFor = async (ctx, boardPath, { readOnly = false } = {}) => {
+    const runtime = await prepareRouterRuntimeWithHealth({
+      repoRoot: ctx?.cwd || process.cwd(), boardPath,
+      defaultsPath: ctx?.routerDefaultsPath ?? null, profilePath: ctx?.routerProfilePath ?? null,
+      dbPath: ctx?.routerDbPath ?? null, cacheRoot: ctx?.routerCacheRoot ?? null,
+      consumptionReceipts: ctx?.consumptionReceipts ?? [], readOnly,
+      fetchFn: ctx?.routerHealthFetch ?? null,
+    });
+    const installed = new Set(runtime.routerConfig.seats.map((seat) => seat.model).filter((model) => {
+      try { return ctx?.modelRegistry?.get?.(model) != null; } catch { return false; }
+    }));
+    runtime.routerSnapshot.modelInstalled = installed;
+    return { ...runtime, activeSessions: ctx?.activeSessions ?? [], providerLimit: ctx?.providerLimit ?? null };
+  };
+
   const result = registerPulseTools(pi, {
     resolveBoardPath: (ctx) => resolveBoardPath(typeof ctx === "string" ? ctx : ctx?.cwd || process.cwd()),
     spawnWorker,
+    routerRuntimeFor,
   });
 
   // Optional timer (§8): created only after session_start, only when the
@@ -43,6 +66,9 @@ export default function pulsePi(pi) {
       timer.clear();
       timer = null;
     }
+    // Release the cached per-dbPath store handles with the session so the
+    // runtime never accumulates DatabaseSync handles (W5).
+    closeCachedRouterStores();
   };
   const setupTimer = async (_event, ctx) => {
     clearTimer();
@@ -54,10 +80,15 @@ export default function pulsePi(pi) {
       const check = checkAutomationPolicy(policy, { boardPath });
       const pulse = check.ok ? check.policy.pulse : null;
       if (!pulse || pulse.enabled !== true || pulse.mode !== "automated") return;
+      // W3: the tick asks for a FRESH runtime every tick instead of reusing a
+      // setup-time snapshot. The factory re-reads collector caches, health
+      // probes, and the prior-reservation term under the read-time freshness
+      // rules; a factory failure fails that tick closed.
       timer = createPulseTimer({
         intervalSeconds: pulse.intervalSeconds,
         fillOnStart: pulse.fillOnStart === true,
-        tick: () => pulseTick({ boardPath, spawnWorker, context: ctx }),
+        tick: () => pulseTick({ boardPath, spawnWorker, context: ctx,
+          routerRuntimeFor: () => routerRuntimeFor(ctx, boardPath, { readOnly: false }) }),
       });
       timer.start();
     } catch {

package/extensions/task-board.ts

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // BOARD-1 provider extension. Both tools register at startup; the board is
 // resolved per tool call from the calling session's working directory. A

package/lib/adapters/diff-scope.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // diff-scope adapter — changed-range extraction for code-phage.
 //

package/lib/adapters/evidence.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // evidence adapter — content-bound source anchors for code-phage.
 //

package/lib/adapters/narrative.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // narrative adapter — structured, concern-grouped review narrative.
 //

package/lib/adapters/review-feedback.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // review-feedback adapter — two-intent review items for code-phage.
 //

package/lib/adapters/visualization.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // visualization adapter — optional bounded visual payloads for code-phage.
 //

package/lib/code-phage-core.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";

package/lib/python_ast_metrics.py

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-only
 
 #!/usr/bin/env python3
 """AST-backed complexity metrics for code-phage.

package/lib/typescript_ast_metrics.mjs

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import ts from "typescript";
 

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@evoclock/pi-agentic-driver",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Guardrail extensions for Agentic Driver: advisory review, bounded Herdr communication, and guarded worker lifecycle.",
   "type": "module",
-  "license": "AGPL-3.0-or-later",
+  "license": "AGPL-3.0-only",
+  "engines": {
+    "node": ">=22.5.0"
+  },
   "keywords": [
     "pi-package",
     "pi-extension",
@@ -70,6 +73,13 @@
     "scripts/enforcement/task_board_core_pi.js",
     "scripts/enforcement/pulse_core_pi.js",
     "scripts/enforcement/pulse_scheduler_pi.js",
+    "scripts/enforcement/router_engine_pi.js",
+    "scripts/enforcement/router_schemas_pi.js",
+    "scripts/enforcement/router_ranking_pi.js",
+    "scripts/enforcement/router_store_pi.js",
+    "scripts/enforcement/router_replacement_pi.js",
+    "scripts/enforcement/router_runtime_pi.js",
+    ".agentic-driver/router.defaults.json",
     "skills/pulse/SKILL.md"
   ],
   "pi": {

package/scripts/aidr_writing_review.js

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { createHash, randomUUID } from "node:crypto";
 import fs, { realpathSync } from "node:fs";

package/scripts/enforcement/attended_authority_guard.js

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // Attended-authority destructive-command guard for Pi.
 //

package/scripts/enforcement/guest_containment_taxonomy.v1.json

@@ -10,7 +10,7 @@
     {"id":"GC-FSW-003","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"file-growth-anomaly: unexpected growth in cache/package directories (~/.npm, ~/.cache/pip, /var/cache/*) beyond the size-delta threshold","evidence":"METR evaluation logs: bulk cache staging of payloads","since":"v1","disposition":"detector:fs-sweep size-delta sampling (gc_cache_growth_sample; aggregate ELEVATED, GC_CACHE_GROWTH_KIB per sweep)"},
     {"id":"GC-SHR-001","class":"GC-SHR","severity":"HIGH","action":"deny","match":"shared-cache-write: writes to paths shared with other agents or the coordinator; with host-share absent any such attempt is a deny","evidence":"receipt proves host-share=absent; writes would indicate boundary violation","since":"v1","disposition":"detector:fs-path; share paths auto-arm via gc_share_mounted (/proc/mounts); shared-cache roots classify as SHR when unarmed"},
     {"id":"GC-SHR-002","class":"GC-SHR","severity":"HIGH","action":"deny","match":"cross-agent-channel: creation of or writes to inter-agent coordination paths (maildirs, task-queue files, agent state files)","evidence":"HF incident multi-agent escalation; METR coordination/sabotage threat model","since":"v1","disposition":"detector:fs-path+shim-argv heuristics (Maildir, task-queue, agent-channel, coordination paths)"},
-    {"id":"GC-NET-001","class":"GC-NET","severity":"HIGH","action":"deny","match":"socket-open: any entry in /proc/net/tcp, /proc/net/tcp6, /proc/net/udp at any sweep","evidence":"fixture boots with no network device; any socket is exfiltration-capable","since":"v1","disposition":"detector:net-proc-sweep"},
+    {"id":"GC-NET-001","class":"GC-NET","severity":"HIGH","action":"deny","match":"socket-open: any entry in /proc/net/tcp, /proc/net/tcp6, /proc/net/udp not present in the pre-arming socket baseline, at any sweep","evidence":"fixture boots with no network device; any socket is exfiltration-capable","since":"v1","disposition":"detector:net-proc-sweep-baselined"},
     {"id":"GC-NET-002","class":"GC-NET","severity":"HIGH","action":"deny","match":"network-tool-invocation: shim-detects wget, curl, nc, ssh, telnet, ping regardless of arguments","evidence":"METR self-replication exfiltration patterns; HF incident remote control","since":"v1","disposition":"detector:shim-argv"},
     {"id":"GC-CRED-001","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"credential-path-read: opens of ~/.ssh/, ~/.aws/, ~/.netrc, ~/.git-credentials, token files","evidence":"credential theft is step one in every reported agent-escape chain","since":"v1","disposition":"detector:shim-argv"},
     {"id":"GC-CRED-002","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"env-secret-probing: attempts to dump or scan the environment for secret-shaped keys","evidence":"METR evaluation logs; HF incident postmortem credential harvest attempts","since":"v1","disposition":"detector:shim-argv"},

package/scripts/enforcement/herdr_async_dispatch_pi.js

@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
-// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-License-Identifier: AGPL-3.0-only
 
 // Async continuous worker dispatch and pulse. One bounded step on top of the
 // shipped herdr-communication interface: a worker progresses through an