@feigi/fleet-ctl 3.23.4 → 3.23.6

package/agents/fleet-implementer-slow-high.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-slow-medium.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-smol-high.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-task-high.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-task-max.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.4",
+  "version": "3.23.6",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/compute-spend.mjs

@@ -286,17 +286,19 @@ export function computeSpend({ agents = [], topN = 8 } = {}) {
 }
 
 // Per-TOOL attribution. Tokens are not billed per tool call, so this is a proxy
-// and is labelled as one everywhere it surfaces: a tool result arrives in a user
-// turn, and the NEXT assistant turn's cache_creation is the cost of writing that
-// result into the cache. When several results land before that turn, the cost is
-// split proportionally by result size, because that is what drove it.
+// and is labelled as one everywhere it surfaces: a tool result arrives as a
+// `toolResult` line, and the NEXT assistant turn's cache_creation is the cost
+// of writing that result into the cache. When several results land before that
+// turn, the cost is split proportionally by result size, because that is what
+// drove it.
 //
-// Those results arrive as CONSECUTIVE user turns, not as one turn carrying
-// several blocks: across 45,062 real result-bearing turns, not one carried two
-// tool_results. Parallel tool calls show up as N single-result turns in a row
-// (4,087 occurrences). So `pending` must ACCUMULATE across consecutive result
-// turns — replacing it dropped every batch but the last, losing 9.1% of all
-// attributions, and left the proportional split below unreachable on real data.
+// Those results arrive as CONSECUTIVE result lines, not as one turn carrying
+// several blocks: in omp transcripts each tool result sits on its own line
+// (measured on 176,027 results, recorded beside the reader in
+// member-record.mjs). Parallel tool calls show up as N single-result lines in a
+// row. So `pending` must ACCUMULATE across consecutive result lines —
+// replacing it dropped every batch but the last, and left the proportional
+// split below unreachable on real data.
 //
 // The proxy over-attributes slightly — that next turn also caches the assistant's
 // own preceding output — so treat these as shares, not absolutes. `resultChars`

package/scripts/compute-spend.test.mjs

@@ -44,12 +44,11 @@ const CONSECUTIVE = [
 ];
 const ORPHAN = [result(["orphan", 100]), { kind: "assistant", cacheWrite: 50, tools: [] }];
 
-test("CONSECUTIVE result turns accumulate — that, not the multi-block turn, is the real shape", () => {
-  // Regression. Parallel tool calls do NOT arrive as one user turn carrying two
-  // tool_result blocks: across 45,062 real result-bearing turns, none carried
-  // two. They arrive as N single-result turns in a row (4,087 occurrences).
-  // Replacing `pending` per result turn dropped every batch but the last —
-  // 9.1% of all attributions — and made the proportional split above dead code.
+test("CONSECUTIVE result entries accumulate — that, not one multi-result entry, is the real shape", () => {
+  // Regression: parallel tool calls arrive as N single-result entries in a row,
+  // not as one entry carrying several results (see the attributeTools comment).
+  // Replacing `pending` per result entry dropped every batch but the last, and
+  // made the proportional split unreachable.
   const tools = attributeTools(CONSECUTIVE);
   const by = Object.fromEntries(tools.map((t) => [t.tool, t.cacheWrite]));
   assert.equal(by.Read, 750);

package/scripts/dispatch-block-golden-prose.test.mjs

@@ -358,8 +358,8 @@ const REGION_BLOCKS = [
       "**A subagent you dispatch gets its own directory under yours,",
       "`<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its",
       "prompt — it writes nowhere else, and never derives a path of its own.**",
-      "`<childName>` is a slug of the name you dispatch it under (omp's task `name`,",
-      "Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,",
+      "`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —",
+      "`[a-z0-9-]` only, never the raw field itself,",
       "which can carry spaces and `/` and would split or nest the path in an",
       "unquoted shell command — unique among your children and never one of your",
       "own entries (`probe`, `mutate`, or any other name you write under",

package/scripts/dispatch-block-pins-prose.test.mjs

@@ -373,7 +373,7 @@ test("the scratch-discipline block names the shared injected root, the per-membe
   // The name the path is keyed on, bound to what makes it collision-free.
   assert.match(
     b,
-    phrase("`<childName>` is a slug of the name you dispatch it under (omp's task `name`, Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself, which can carry spaces and `/` and would split or nest the path in an unquoted shell command — unique among your children and never one of your own entries (`probe`, `mutate`, or any other name you write under `<scratch>/impl-<N>/` yourself), so no child shares a directory with a sibling or with you"),
+    phrase("`<childName>` is a slug of the name you dispatch it under (omp's task `name`) — `[a-z0-9-]` only, never the raw field itself, which can carry spaces and `/` and would split or nest the path in an unquoted shell command — unique among your children and never one of your own entries (`probe`, `mutate`, or any other name you write under `<scratch>/impl-<N>/` yourself), so no child shares a directory with a sibling or with you"),
     "`<childName>` is no longer defined as a slugged, own-entry-safe dispatch name unique among the parent's children",
   );
 });

package/scripts/fan-out-authorization-prose.test.mjs

@@ -0,0 +1,80 @@
+// A reviewer that holds the dispatch tool still has to be TOLD the fan-out is
+// requested work, or it declines to dispatch the specialists and the run
+// silently downgrades to a thinner solo review. Two documents say so: run-team's
+// "Authorize the fan-out explicitly" paragraph, and member-lifecycle.md's
+// "Capability is not permission" section.
+//
+// What the rule rests on is the distinction itself — holding the tool is not
+// authorization to use it — and not on any standing instruction an omp member
+// inherits. The retired wording named such an instruction (`AgentTool`) and
+// rested the rule on that inheritance; reverting either document to it left
+// every other test green, because nothing read these two passages at all.
+//
+// Each passage is sliced to its own paragraph or section, never matched
+// file-wide: both documents discuss the fan-out in many other places, and a
+// file-wide match is satisfied by any of them while the rule's own wording is
+// gutted. Every match goes through `phrase()`, which tolerates a rewrap of the
+// same words — a pin that reds on a reflow discriminates nothing.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { between, paragraph, phrase } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..");
+const read = (...p) => readFileSync(join(REPO, ...p), "utf8");
+
+const SKILL = read("skills", "run-team", "SKILL.md");
+const LIFECYCLE = read("skills", "run-team", "references", "member-lifecycle.md");
+
+// [label, passage, the sentence stating "holding the tool is not authorization",
+//  the sentence stating what the reviewer must be told]. The two documents word
+// the same rule differently, so each carries its own spelling.
+const PASSAGES = [
+  [
+    "run-team/SKILL.md's 'Authorize the fan-out explicitly' paragraph",
+    paragraph(SKILL, "Authorize the fan-out explicitly.", "run-team/SKILL.md"),
+    "holding the dispatch tool is not authorization to use it",
+    "State that the full specialist set IS the requested work",
+  ],
+  [
+    "member-lifecycle.md's 'Capability is not permission' section",
+    between(LIFECYCLE, "## Capability is not permission", "\n## ", "references/member-lifecycle.md"),
+    "Holding the dispatch tool does not authorize using it",
+    "reviewer prompt must state full specialist set IS requested work",
+  ],
+];
+
+test("both fan-out passages say holding the dispatch tool is not authorization to use it", () => {
+  for (const [label, passage, notAuthorization] of PASSAGES) {
+    assert.match(
+      passage,
+      phrase(notAuthorization),
+      `${label} no longer says "${notAuthorization}" — without it a reviewer that holds the dispatch tool reads the fan-out as optional and silently downgrades to a thinner solo review`,
+    );
+  }
+});
+
+test("both fan-out passages tell the controller to state the full specialist set IS the requested work", () => {
+  for (const [label, passage, , mustState] of PASSAGES) {
+    assert.match(
+      passage,
+      phrase(mustState),
+      `${label} no longer says "${mustState}" — the controller is no longer told what the reviewer prompt must carry`,
+    );
+  }
+});
+
+test("neither fan-out passage rests the rule on a standing instruction the member inherits", () => {
+  // The retired premise, not a spelling of it: any restatement that grounds the
+  // rule in an inherited do-not-dispatch instruction is the claim this ticket
+  // removed, whichever tool name it uses. `AgentTool` and the verb `inherits`
+  // are the two ways it was written.
+  for (const [label, passage] of PASSAGES) {
+    assert.doesNotMatch(
+      passage,
+      /AgentTool|\binherit/i,
+      `${label} grounds the fan-out rule in an inherited standing instruction again — omp members inherit no such instruction; the rule is that holding the tool is not authorization to use it`,
+    );
+  }
+});

package/scripts/finisher-name-prose.test.mjs

@@ -60,7 +60,7 @@ test("both member-naming lists name every member, the finisher included", () =>
     assert.deepEqual(
       missing,
       [],
-      `${label}'s member-naming list no longer names ${missing.join(", ")} — a controller reading it names that member something else, and a misnamed member loses the Agent tool with no error`,
+      `${label}'s member-naming list no longer names ${missing.join(", ")} — a controller reading it names that member something else, and a misnamed member is invisible to the ledger and unreachable by \`hub send\``,
     );
   }
 });

package/scripts/member-record.mjs

@@ -1,8 +1,8 @@
 // The member-telemetry adapter. ONE per-member
-// record shape, TWO readers a tree walk chooses by content, never by
-// caller-supplied config: board.mjs (the live spend panel) and
+// record shape, ONE transcript reader (`foldOmpTranscript`, `readOmpMember`):
+// board.mjs (the live spend panel) and
 // member-outcomes.mjs (the scraper) build on the primitives here rather than
-// each inlining a transcript layout, so the fold-back arithmetic, the cwd
+// each inlining a transcript layout, so the per-turn fold, the cwd
 // encoder and the ticket/PR extraction each live in exactly one place.
 //
 // The record: harness, session, role, agent, model, thinking,
@@ -39,16 +39,16 @@ import { classifyRole, canonicalMemberName, CANONICAL_MEMBER_NAME_PREFIXES } fro
 // callers who need to encode a cwd that is not guaranteed to exist — every
 // caller but board.mjs's own live panel — pass their own resolver.
 //
-// Encodes the way the fleet's own tooling reads it back: every
-// non-alphanumeric character with `-`, so `-Users-x-claude` decodes to
-// `/Users/x/.claude`, not `-Users-x.claude`. Home-relative paths become
-// `~/...`-style (`-` under $HOME) joined by `-` with DOTS PRESERVED
-// (`.claude` -> `-.claude`); non-home paths are realpath-resolved (so `/tmp/x`,
+// Encodes the way omp's own session directory naming does, by path SEGMENT:
+// the segments are split on the path separator, empty ones dropped, and joined
+// with `-`; every other character is kept, dots and underscores included.
+// Home-relative paths become `-` plus their segments
+// (`/Users/x/.claude/a_b` under home `/Users/x` -> `-.claude-a_b`);
+// non-home paths are realpath-resolved (so `/tmp/x`,
 // a symlink to `/private/tmp/x` on macOS, encodes under the resolved name)
-// and double-dash-wrapped. Both forms are measured against real
-// `~/.omp/agent/sessions/*` directory names - a
-// `~/dev/fleet-plugin`, `--private-tmp-fx685-scratch--` all exist on disk
-// today.
+// and wrapped in `--` (`/opt/a.b` -> `--opt-a.b--`). Both forms are measured
+// against real `~/.omp/agent/sessions/*` directory names: `-dev-fleet-plugin`
+// and `--private-tmp-fix685-scratch--` both exist on disk today.
 export function encodeProjectDir(cwd, { home = process.env.HOME, realpath = realpathSync } = {}) {
   const rel = relative(home, cwd);
   const isHome = !rel.startsWith("..") && !isAbsolute(rel);
@@ -188,7 +188,7 @@ function specialistPr(name) {
 // signals a corrupted or foreign file, not a harness to dispatch to.
 //
 // Both halves of that signature are checked, not just the blocklist half: a
-// line carrying neither Claude's keys NOR omp's own `type` field (e.g. a
+// line carrying neither a `sessionId`/`parentUuid` key NOR omp's own `type` field (e.g. a
 // foreign/corrupted `{"foo":"bar"}`) used to sail past the blocklist-only
 // check below and fold into a fabricated all-null/zero member record instead
 // of the refusal this comment already promised. `type` is the one envelope

package/skills/run-team/SKILL.md

@@ -1271,12 +1271,10 @@ for d in "$HOME/.omp/agent/sessions/$PROJECT_DIR"/*/; do
 done
 ```
 
-`encodeProjectDir` (`scripts/board.mjs`) encodes the cwd the way omp's own
-session directory naming does — every non-alphanumeric character becomes
-`-`, with a leading dot segment's dot PRESERVED rather than folded into the
-dash run (`member-record.test.mjs`'s regression case: `.claude` becomes
-`-.claude`, not `--claude`) — and hand-guessing that path is why the fleet's
-own panel once rendered nothing here. The trailing `/` on the glob matters:
+`encodeProjectDir` (defined in `scripts/member-record.mjs`, re-exported by
+`scripts/board.mjs`) encodes the cwd exactly as omp names its session
+directories — see its comment for the rule — and hand-guessing that path is why
+the fleet's own panel once rendered nothing here. The trailing `/` on the glob matters:
 the same encoded-cwd directory also holds this cwd's own top-level session
 transcripts as loose FILES sibling to the per-session directories, and a
 glob without it would try to scrape one of those as if it were a session.
@@ -1737,10 +1735,9 @@ It blocks, then prints one line. Which line it is, is the whole protocol:
   Run the tick above **with `--fold-unchanged`** and act on what it prints.
   Then arm the beat again.
 - `… Ns of Ms remain → re-issue this command now, do not end your turn` — no
-  command blocks for a whole interval (omp backgrounds one at
-  60s, which is why the
-  CI gate tells you to re-issue `gh run watch`). Issue it again. That is still
-  one blocking call per turn, never an idle turn.
+  command blocks for a whole interval (omp backgrounds one at 60s, which is
+  why the CI gate holds its wait in one `eval` cell polling `gh run view`).
+  Issue it again. That is still one blocking call per turn, never an idle turn.
 
 The interval doubles while the fleet asks for nothing and stops at `--ceiling`,
 so a quiet night costs ~26 wakes instead of ~96. **The ceiling is a real bound,
@@ -2981,8 +2978,9 @@ its own survivors, so the zero is what tells the tick no fix-applier is owed —
 and it reaches a finisher through the same gate as any other PR.
 
 **Authorize the fan-out explicitly.** State that the full specialist set IS the
-requested work — otherwise the reviewer inherits the standing "do not call the
-AgentTool unless requested" and silently downgrades to a thinner solo review.
+requested work — holding the dispatch tool is not authorization to use it, and
+a reviewer not told so declines the fan-out and silently downgrades to a
+thinner solo review.
 Nothing computes the count here, so apply the heuristic yourself: two or three
 specialists for annotation-only or single-file, the full set for production code.
 See references/member-lifecycle.md.

package/skills/run-team/references/member-lifecycle.md

@@ -1,6 +1,6 @@
 # Member lifecycle: naming, fresh context, recovery
 
-Why member name load-bearing, why every member single-use, how killed/idle/truncated member recovered. Assertions these justify live in SKILL.md's "Rules that fail silently", Phase 3, Reviewers, Failure handling sections; evidence here.
+Why member name load-bearing, why every member single-use, how a member's job outcome (`completed`/`failed`/`cancelled`) and peer liveness (`running`/`idle`/`parked`) decide its recovery. Assertions these justify live in SKILL.md's "Rules that fail silently", Phase 3, Reviewers, Failure handling sections; evidence here.
 
 ## Every member is named
 
@@ -12,7 +12,7 @@ The name is the ledger token and the hub address (`hub send <name>`, `agent://<n
 
 ## Capability is not permission
 
-Members inherit standing *"Do not call the AgentTool unless the user requested it."* Else reviewer declines to dispatch specialists — correctly — you get thinner solo review, no error, no signal. Having tool (capability) not authorization to use it (permission); reviewer prompt must state full specialist set IS requested work.
+Holding the dispatch tool does not authorize using it: a reviewer not told the fan-out is requested work declines to dispatch specialists, and you get thinner solo review, no error, no signal. Having tool (capability) not authorization to use it (permission); reviewer prompt must state full specialist set IS requested work.
 
 ## The coordination contract