@geraldmaron/construct 1.5.1 → 1.5.3

package/lib/models/catalog.mjs

@@ -11,6 +11,7 @@ import { loadRegistry } from '../registry/loader.mjs';
 import path from 'node:path';
 import os from 'node:os';
 import { pollFreeModels } from '../model-free-selector.mjs';
+import { MODEL_TIERS } from '../model-tiers.mjs';
 import { resolveFirstSecret, hasAnySecret } from '../providers/secret-resolver.mjs';
 import { loadProjectConfig } from '../config/project-config.mjs';
 import { doctorRoot } from '../config/xdg.mjs';
@@ -105,7 +106,7 @@ export function providerFamilyEnabled(providerId, visibility) {
 
 export function collectTierDefaultIds(registryModels = {}) {
   const ids = [];
-  for (const tier of ['reasoning', 'standard', 'fast']) {
+  for (const tier of MODEL_TIERS) {
     const def = registryModels[tier];
     if (typeof def === 'string') ids.push(def);
     else if (def && typeof def === 'object') {
@@ -176,11 +177,11 @@ export function applyModelVisibilityFilter(catalog, {
     .filter((provider) => providerFamilyEnabled(provider.id, visibility))
     .map((provider) => {
       const options = {};
-      for (const tier of ['reasoning', 'standard', 'fast']) {
+      for (const tier of MODEL_TIERS) {
         options[tier] = (provider.options?.[tier] ?? []).filter((id) => modelAllowed(id, provider.id));
       }
       const tiers = { ...provider.tiers };
-      for (const tier of ['reasoning', 'standard', 'fast']) {
+      for (const tier of MODEL_TIERS) {
         if (tiers[tier] && !modelAllowed(tiers[tier], provider.id)) {
           tiers[tier] = options[tier]?.[0] ?? null;
         }
@@ -260,6 +261,6 @@ export function isModelVisible(modelId, {
     { visibility, registryModels, activeModelId },
   );
   return filtered.providers.some((p) =>
-    ['reasoning', 'standard', 'fast'].some((tier) => (p.options[tier] ?? []).includes(modelId)),
+    MODEL_TIERS.some((tier) => (p.options[tier] ?? []).includes(modelId)),
   );
 }

package/lib/orchestration/classification.mjs

@@ -49,6 +49,17 @@ const DOC_AUTHORING_PATTERNS = [
   { pattern: /\bchangelog/i, docType: 'changelog' },
 ];
 
+// The docType each pattern maps to must exist in the routing registry's
+// knownDocTypes(), or detectDocAuthoringIntent returns a docType with a null
+// owner and the request silently loses its canonical author. A drift-guard test
+// (tests/orchestration-doc-authoring-patterns.test.mjs) asserts the subset,
+// since the mapping cannot be generated from the registry (the regex is
+// natural-language, only the docType string is registry-owned) — construct-v1wk.
+
+export function docAuthoringDocTypes() {
+  return DOC_AUTHORING_PATTERNS.map(({ docType }) => docType);
+}
+
 const AUTHORING_VERBS = /\b(write|writing|draft|drafting|create|creating|author|authoring|produce|producing|compose|composing|prepare|preparing|generate|generating)\b/i;
 
 /**

package/lib/orchestration/context-bindings.mjs

@@ -0,0 +1,85 @@
+/**
+ * lib/orchestration/context-bindings.mjs — resolve per-run context-target
+ * bindings for orchestration runs (bead construct-760c.4).
+ *
+ * An orchestration run can name which registered source targets it should draw
+ * context from — `contextTargets: [{id, role?}]`. This module validates those
+ * ids against the project's effective `sources.targets[]` at PLAN time and
+ * resolves each to a binding record persisted on the run for audit and picked up
+ * by the run's retrieval path. An unknown id is a hard error before any task is
+ * built (never a silent skip), so a run never plans against context it can't
+ * reach.
+ *
+ * `role` is an optional free-form hint (e.g. "tracker", "reference") threaded
+ * verbatim onto the binding — there is no role enum in core. Content-capable
+ * targets (directory / synced corpus, via lib/sources/content-roots.mjs) also
+ * carry a resolved `contentRoot` so a directory-bound run can read the docs
+ * directly; targets with no local content (a tracker like jira) resolve to a
+ * binding with `contentRoot: null` and provider identity only.
+ */
+
+import { resolveEffectiveSourceTargetsFromConfig } from '../config/source-targets.mjs';
+import { resolveContentRoots } from '../sources/content-roots.mjs';
+
+export class ContextTargetError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'ContextTargetError';
+    this.code = 'CONTEXT_TARGET_UNKNOWN';
+  }
+}
+
+function normalizeRequests(contextTargets) {
+  if (contextTargets == null) return [];
+  const list = Array.isArray(contextTargets) ? contextTargets : [contextTargets];
+  return list
+    .map((entry) => (typeof entry === 'string' ? { id: entry } : entry))
+    .filter((entry) => entry && typeof entry === 'object' && typeof entry.id === 'string' && entry.id.trim())
+    .map((entry) => ({ id: entry.id.trim(), role: entry.role != null ? String(entry.role) : null }));
+}
+
+/**
+ * Resolve requested context targets into binding records, or throw
+ * ContextTargetError naming the offending id and the known ids. Returns an empty
+ * array when nothing is requested — the caller then falls back to today's
+ * implicit source resolution, unchanged.
+ *
+ * @param {Array<{id: string, role?: string}>|string[]} contextTargets
+ * @param {object} opts
+ * @param {object} opts.config    loaded project config
+ * @param {object} [opts.env]
+ * @param {string} [opts.cwd]     project root, for content-root resolution
+ * @returns {{id, provider, role, resolution, contentRoot, ref}[]}
+ */
+export function resolveContextBindings(contextTargets, { config, env = process.env, cwd = process.cwd() } = {}) {
+  const requests = normalizeRequests(contextTargets);
+  if (!requests.length) return [];
+
+  const targets = resolveEffectiveSourceTargetsFromConfig(config, env);
+  const byId = new Map(targets.map((t) => [t.id, t]));
+  const contentRoots = resolveContentRoots(targets, { projectRoot: cwd });
+  const rootByTargetId = new Map(contentRoots.map((r) => [r.origin.targetId, r]));
+
+  const bindings = [];
+  const seen = new Set();
+  for (const req of requests) {
+    if (seen.has(req.id)) continue;
+    seen.add(req.id);
+
+    const target = byId.get(req.id);
+    if (!target) {
+      const known = [...byId.keys()].join(', ') || '(none registered)';
+      throw new ContextTargetError(`unknown context target "${req.id}" — known targets: ${known}`);
+    }
+    const root = rootByTargetId.get(req.id) || null;
+    bindings.push({
+      id: target.id,
+      provider: target.provider,
+      role: req.role,
+      resolution: 'resolved',
+      contentRoot: root ? root.dir : null,
+      ref: root ? root.origin.ref : null,
+    });
+  }
+  return bindings;
+}

package/lib/orchestration/readiness.mjs

@@ -12,6 +12,7 @@ import { dirname, join } from 'node:path';
 import { getInstalledVersion } from '../version.mjs';
 import { CONTRACT_VERSION, MIN_CLIENT_CONTRACT_VERSION } from '../embedded-contract/contract-version.mjs';
 import { getDeploymentMode } from '../deployment-mode.mjs';
+import { MODEL_TIERS } from '../model-tiers.mjs';
 import { doctorRoot } from '../config/xdg.mjs';
 import { resolveExecution } from '../embedded-contract/execution.mjs';
 import { resolveEmbeddedModel } from '../embedded-contract/model-resolve.mjs';
@@ -165,7 +166,7 @@ export function buildOrchestrationReadiness(input = {}, { env = process.env, cwd
   const workerBackend = resolveWorkerBackend({ config });
   const modelResolved = {};
   let firstUnresolvedTier = null;
-  for (const tier of ['reasoning', 'standard', 'fast']) {
+  for (const tier of MODEL_TIERS) {
     const resolved = resolveEmbeddedModel({ requestedTier: tier }, { env });
     modelResolved[tier] = resolved.resolutionSource !== 'config-error';
     if (!modelResolved[tier] && !firstUnresolvedTier) firstUnresolvedTier = tier;

package/lib/orchestration/research-evidence-gate.mjs

@@ -0,0 +1,104 @@
+/**
+ * lib/orchestration/research-evidence-gate.mjs — deterministic evidence gate for
+ * research task output.
+ *
+ * The cx-researcher persona forbids fabrication and mandates honest
+ * insufficient-evidence, but that is honor-system enforcement (a persona prompt)
+ * — a weak model, including any free-tier host model, ignores it and ships a
+ * confident answer with no sources (construct-6yo6o: a Free-Models-Router session
+ * fabricated a whole "research" answer, zero citations, every web fetch failed).
+ *
+ * The deterministic backstop applies wherever a research task's output is
+ * finalized (provider AND host backends), independent of model tier — validating
+ * the OUTPUT, never the choice of model, so the user's free-model choice is
+ * honored (no paid escalation). Complements findUnverifiedCitations (which flags
+ * a cited URL absent from governed webEvidence) by catching the opposite gap: an
+ * answer that cites NOTHING of the evidence kind its own research mode requires.
+ *
+ * A substantial research answer that carries no citation of its expected kind is
+ * unverifiable and is flagged degraded rather than presented as done. It stays a
+ * signal, not a hard failure: the task still completes (the output exists), but a
+ * surface can see it was never grounded. An honestly short or self-declared
+ * insufficient-evidence answer is never penalized — that is the behavior the
+ * persona asks for.
+ */
+
+const RESEARCH_ROLES = new Set(['researcher', 'cx-researcher']);
+
+// Shorter answers are too brief to be a load-bearing research claim — an honest
+// "insufficient evidence" reply falls here and must pass untouched.
+const SUBSTANTIVE_MIN_CHARS = 500;
+
+const CODEBASE_HINTS = /\b(codebase|repo|repository|source code|source file|implementation|the code|this file|which function|call site|grep|trace (the|through)|execution path)\b/i;
+const UX_HINTS = /\b(user research|ux research|usability|interview|transcript|user journey|friction points?|jobs.to.be.done|personas?)\b/i;
+
+// An answer that declares its own limits is honest degradation, not fabrication,
+// and passes at any length.
+const SELF_DEGRADED = /insufficient evidence|could not (reach|verify|access|retrieve|confirm)|no (live )?web access|unable to (verify|reach|retrieve)|\[unverified\]|no verifiable sources?|without (live |web )?access/i;
+
+const URL_RE = /\bhttps?:\/\/[^\s)\]<>"']+/g;
+const DOI_ARXIV_RE = /\b(?:doi:\s*10\.\d{4,}|arxiv:\s*\d{4}\.\d{4,})/gi;
+const FILELINE_RE = /\b[\w./-]+\.[a-z0-9]{1,6}:\d+\b/gi;
+const TRANSCRIPT_RE = /\b(?:transcript|recording|interview|participant|session)\b[^.\n]{0,60}(?:\d{4}-\d{2}|#\d+|P\d+|\.(?:txt|md|vtt|srt|json))/gi;
+
+function countMatches(text, re) {
+  const m = String(text).match(re);
+  return m ? m.length : 0;
+}
+
+/**
+ * Infer which evidence kind a research request expects. Codebase questions cite
+ * file:line, user/UX questions cite transcripts, everything else cites external
+ * verifiable sources (URLs / DOIs / arXiv ids).
+ */
+export function inferEvidenceKind(request = '') {
+  const text = String(request || '');
+  if (CODEBASE_HINTS.test(text)) return 'codebase';
+  if (UX_HINTS.test(text)) return 'ux';
+  return 'external';
+}
+
+function countEvidenceForKind(output, kind) {
+  if (kind === 'codebase') return countMatches(output, FILELINE_RE);
+  if (kind === 'ux') return countMatches(output, TRANSCRIPT_RE);
+  return countMatches(output, URL_RE) + countMatches(output, DOI_ARXIV_RE);
+}
+
+const KIND_REMEDIATION = {
+  external: 'cite at least one verifiable primary source (a fetched URL, DOI, or arXiv id)',
+  codebase: 'cite at least one file:line reference from a read you performed',
+  ux: 'cite at least one transcript, recording, or participant reference',
+};
+
+/**
+ * Gate a research task's output on evidence presence.
+ *
+ * @param {{output?: string, role?: string, request?: string}} params
+ * @returns {{applicable: boolean, ok: boolean, kind: string|null, citationCount: number, reason: string|null}}
+ */
+export function gateResearchEvidence({ output = '', role = '', request = '' } = {}) {
+  const normalizedRole = String(role || '').replace(/^cx-/, '');
+  if (!RESEARCH_ROLES.has(normalizedRole) && !RESEARCH_ROLES.has(String(role || ''))) {
+    return { applicable: false, ok: true, kind: null, citationCount: 0, reason: null };
+  }
+
+  const text = String(output || '');
+  const kind = inferEvidenceKind(request);
+
+  if (text.trim().length < SUBSTANTIVE_MIN_CHARS || SELF_DEGRADED.test(text)) {
+    return { applicable: true, ok: true, kind, citationCount: countEvidenceForKind(text, kind), reason: null };
+  }
+
+  const citationCount = countEvidenceForKind(text, kind);
+  if (citationCount > 0) {
+    return { applicable: true, ok: true, kind, citationCount, reason: null };
+  }
+
+  return {
+    applicable: true,
+    ok: false,
+    kind,
+    citationCount: 0,
+    reason: `${kind}-research output carries no verifiable citation — ${KIND_REMEDIATION[kind]}, or return insufficient-evidence instead of an unsourced answer`,
+  };
+}

package/lib/orchestration/runtime.mjs

@@ -59,9 +59,11 @@ import { resolveRunStore, projectKey } from './store.mjs';
 import { resolveTraceStore } from './trace-store.mjs';
 import { runTaskViaProvider, materializeTaskPrompt, INLINE, PROVIDER, HOST, WORKER_BACKEND_SET } from './worker.mjs';
 import { roleHoldsWebCapability } from './web-capability.mjs';
+import { gateResearchEvidence } from './research-evidence-gate.mjs';
 import { emitRunEvent, isCancelRequested, clearCancel } from './events.mjs';
 import { getDeploymentMode } from '../deployment-mode.mjs';
 import { resolveTenantContext } from '../tenant/context.mjs';
+import { resolveContextBindings } from './context-bindings.mjs';
 
 export const WORKER_BACKENDS = WORKER_BACKEND_SET;
 export const DEFAULT_WORKER_BACKEND = INLINE;
@@ -203,10 +205,16 @@ export async function planRun(request = {}, { env = process.env, cwd = process.c
   const {
     request: text = '', workflowType = null, requestedStrategy = 'auto', useConstruct = true,
     host = null, hostModel = null, hostProvider = null, fileCount = 0, moduleCount = 0,
-    workerBackend: explicitWorkerBackend = null,
+    workerBackend: explicitWorkerBackend = null, contextTargets = null,
   } = request;
 
   const { config, configWarnings } = loadConfigWithWarnings(cwd, env);
+
+  // Context-target bindings (B4) are validated here, before any task is built or
+  // any run record is saved, so an unknown id fails the whole plan closed rather
+  // than persisting a run bound to context it cannot reach. Omission resolves to
+  // an empty list and leaves today's implicit source resolution untouched.
+  const contextBindings = resolveContextBindings(contextTargets, { config, env, cwd });
   const { store, warnings: storeWarnings, degraded: storeDegraded, degradedReason: storeDegradedReason } = resolveRunStore({ config, env, cwd });
   if (storeDegraded) {
     process.stderr.write(`[construct] orchestration store degraded (${storeDegradedReason ?? 'unknown'}): ${storeWarnings.join('; ')}\n`);
@@ -261,6 +269,9 @@ export async function planRun(request = {}, { env = process.env, cwd = process.c
     warnings: [...(execData.warnings || []), ...storeWarnings, ...configWarnings],
     semantics: RUNTIME_SEMANTICS,
     executionSemantics: execData.semantics,
+    // Only present when the run was given explicit context targets, so a run
+    // without them stays byte-identical to a pre-B4 record (R1/AC3).
+    ...(contextBindings.length ? { contextBindings } : {}),
   };
 
   await store.saveRun(run);
@@ -289,6 +300,23 @@ function prepareTaskInline(task) {
   if (roleHoldsWebCapability(task.role)) task.webCapability = 'prepare-only';
 }
 
+// Deterministic evidence gate on a finalized research task, applied to both the
+// provider and host backends so the model tier is irrelevant. A substantial
+// cx-researcher answer with no citation of its expected kind is marked degraded
+// (evidenceGate.ok=false) rather than presented as verified — the persona's
+// no-fabrication contract is honor-system, so the gate is the enforcement.
+
+function applyResearchEvidenceGate(task, run) {
+  const verdict = gateResearchEvidence({
+    output: task.output,
+    role: task.role,
+    request: run?.request?.summary || run?.request || '',
+  });
+  if (!verdict.applicable) return;
+  task.evidenceGate = { ok: verdict.ok, kind: verdict.kind, citationCount: verdict.citationCount };
+  if (!verdict.ok) task.evidenceGate.reason = verdict.reason;
+}
+
 // The provider backend executes one task against the configured model. A failed
 // task is recorded (status `failed`, task.error) and does not abort the run, so
 // one specialist failure cannot lose the work of the others.
@@ -305,6 +333,7 @@ async function executeTaskViaProvider(task, run, env, fetchImpl, chainOfThought,
     task.executor = `provider:${result.provider}:${result.model}`;
     task.status = 'done';
     task.finishedAt = new Date().toISOString();
+    applyResearchEvidenceGate(task, run);
 
     // Web-capable execution records which grant mode reached (or did not reach) the web
     // and the F08-governed evidence gathered, so a host never has to infer it (ADR-0050).
@@ -695,6 +724,7 @@ export async function submitHostTaskResult(cwd, runId, taskId, result = {}, { en
   task.status = 'done';
   task.finishedAt = new Date().toISOString();
   task.executionState = 'executed';
+  applyResearchEvidenceGate(task, run);
   // Host-reported, never independently verified — the distinguishing marker a
   // reader needs so this never looks like a construct-verified provider
   // execution (which carries no provenanceSource field at all).
@@ -807,10 +837,14 @@ export function hostAdapterMetadata(run) {
       // a host-reported one.
       ...(t.provenanceSource ? { provenanceSource: t.provenanceSource } : {}),
       ...(t.hostPrompt ? { hostPrompt: t.hostPrompt } : {}),
+      ...(t.evidenceGate ? { evidenceGate: t.evidenceGate } : {}),
     })),
     warnings: run.warnings || [],
     semantics: run.semantics,
     executionSemantics: run.executionSemantics,
+    // Resolved context-target bindings (B4): a typed absence for a run planned
+    // without them, so an inspecting host never infers bindings that weren't set.
+    contextBindings: run.contextBindings ?? [],
   };
 }
 

package/lib/orchestration/worker.mjs

@@ -143,6 +143,15 @@ function classifyWorkerProvider(provider, model) {
   const p = (provider || '').toLowerCase();
   if (p === 'github-copilot' || /^github-copilot\//.test(model || '')) return 'github-copilot';
   if (p === 'openai') return 'openai';
+
+  // A model served through OpenRouter carries an explicit `openrouter/` slug (or
+  // the caller names openrouter), so it dispatches to OpenRouter even when the
+  // underlying family is Anthropic/Claude — the prefix wins over the isAnthropic
+  // substring heuristic, symmetric with how `openai/*` slugs stay on OpenRouter
+  // unless provider is explicitly `openai`. Without this, openrouter/anthropic/
+  // claude-* misroutes to the direct Anthropic endpoint (construct-olpf).
+
+  if (/^openrouter\//.test(model || '') || p.startsWith('openrouter')) return 'openrouter';
   if (isAnthropic(provider, model)) return 'anthropic';
   return 'openrouter';
 }

package/lib/review-pr.mjs

@@ -0,0 +1,102 @@
+/**
+ * lib/review-pr.mjs — deterministic PR-diff review backing `construct review pr`
+ * and the CI `review` gate (.github/workflows/pr-review.yml).
+ *
+ * Reviews HEAD against a base ref under the constraint set of a fork-PR
+ * runner: zero repo secrets and zero model access. Diff shape comes from
+ * summarizeDiff; per-file findings come from scanFile's secret and quality
+ * heuristics over the added and modified files. Findings are advisory — the
+ * command exits non-zero only when the review itself cannot run (bad ref,
+ * not a repository), never on findings, because blocking enforcement belongs
+ * to the dedicated gates (secret scanning, lint suite). ADR-0069 records the
+ * decision that replaced the never-implemented cx-reviewer persona invocation
+ * with this backend.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { scanFile, summarizeDiff } from './mcp/tools/project.mjs';
+
+const MAX_SCANNED_FILES = 200;
+
+export function reviewPrDiff({ baseRef, cwd = process.cwd() } = {}) {
+  if (typeof baseRef !== 'string' || !baseRef.trim()) {
+    return { error: 'baseRef is required' };
+  }
+
+  // Three-dot semantics (merge-base..HEAD) so the review sees only the PR's
+  // own changes, never the base branch's drift since the fork point.
+
+  const base = baseRef.trim();
+  const diff = summarizeDiff({ base_ref: `${base}...HEAD`, cwd });
+  if (diff.error) return { error: diff.error };
+
+  const reviewable = diff.changes.filter((c) => c.status === 'A' || c.status === 'M');
+  const scanned = reviewable.slice(0, MAX_SCANNED_FILES);
+  const skipped = reviewable.length - scanned.length;
+
+  const findings = [];
+  for (const change of scanned) {
+    const scan = scanFile({ cwd, file_path: change.file });
+    if (scan.error) {
+      findings.push({ severity: 'info', file: change.file, message: `${change.file}: not scanned (${scan.error})` });
+      continue;
+    }
+    for (const secret of scan.secrets ?? []) {
+      findings.push({
+        severity: 'high',
+        file: change.file,
+        line: secret.line,
+        message: `possible secret (${secret.pattern}) at ${change.file}:${secret.line}`,
+      });
+    }
+    for (const issue of scan.quality_issues ?? []) {
+      findings.push({
+        severity: 'info',
+        file: change.file,
+        ...(issue.line ? { line: issue.line } : {}),
+        message: `${issue.type} in ${change.file}: ${issue.detail}`,
+      });
+    }
+  }
+
+  const high = findings.filter((f) => f.severity === 'high').length;
+  const counts = `${findings.length} finding${findings.length === 1 ? '' : 's'} (${high} high) across ${scanned.length} scanned file${scanned.length === 1 ? '' : 's'}.`;
+  const cap = skipped > 0 ? ` ${skipped} additional changed file${skipped === 1 ? '' : 's'} not scanned (cap: ${MAX_SCANNED_FILES}).` : '';
+
+  return {
+    generated_by: 'construct review pr',
+    base_ref: base,
+    diff: { files_changed: diff.files_changed, insertions: diff.insertions, deletions: diff.deletions },
+    scanned_files: scanned.length,
+    skipped_files: skipped,
+    summary: `Deterministic diff review — ${diff.summary} ${counts}${cap}`,
+    findings,
+  };
+}
+
+export function runReviewPrCli(argv, { cwd = process.cwd() } = {}) {
+  let baseRef = null;
+  let output = null;
+  for (const arg of argv) {
+    if (arg.startsWith('--base=')) baseRef = arg.slice('--base='.length);
+    else if (arg.startsWith('--output=')) output = arg.slice('--output='.length);
+    else return { exitCode: 1, error: `Unknown argument: ${arg}\nUsage: construct review pr --base=<ref> [--output=<file>]` };
+  }
+  if (!baseRef) {
+    return { exitCode: 1, error: 'Usage: construct review pr --base=<ref> [--output=<file>]' };
+  }
+
+  const result = reviewPrDiff({ baseRef, cwd });
+  if (result.error) return { exitCode: 1, error: result.error };
+
+  const json = JSON.stringify(result, null, 2);
+  let outputPath = null;
+  if (output) {
+    outputPath = path.resolve(cwd, output);
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+    fs.writeFileSync(outputPath, `${json}\n`);
+  }
+  return { exitCode: 0, result, json, outputPath };
+}

package/lib/setup.mjs

@@ -26,6 +26,7 @@ import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 
 import { ensureUserConfigDir, getUserEnvPath, writeEnvValues } from './env-config.mjs';
+import { MODEL_TIERS } from './model-tiers.mjs';
 import { migrateLegacyModelConfig, migrateLegacyCredentialConfig } from './config/legacy-config-migration.mjs';
 import { configDir, stateDir, doctorRoot } from './config/xdg.mjs';
 import { DEFAULT_WORKSPACE_PATH, WORKSPACE_DOCS_LANES } from './embed/config.mjs';
@@ -536,7 +537,7 @@ export async function runSetup({ rootDir = ROOT_DIR, args = [], homeDir = HOME }
         const { applyToEnv } = await import('./model-router.mjs');
         const selections = await selectCheapestForAllTiers({ env: process.env });
         const applied = {};
-        for (const tier of ['reasoning', 'standard', 'fast']) {
+        for (const tier of MODEL_TIERS) {
           if (selections[tier]?.modelId) applied[tier] = selections[tier].modelId;
         }
         if (Object.keys(applied).length > 0) {

package/lib/sources/content-roots.mjs

@@ -0,0 +1,147 @@
+/**
+ * lib/sources/content-roots.mjs — resolve content-capable source targets to
+ * on-disk roots for multi-root knowledge corpus builders (bead construct-760c.2).
+ *
+ * A target contributes a filesystem content root when its provider manifest
+ * declares content capability and the concrete content exists on disk:
+ *   - directory targets — the manifest selector declares `existsAs: 'directory'`,
+ *     so the tilde-expanded path IS the root (no cache, always local).
+ *   - corpus targets — the manifest declares a `content` descriptor and the
+ *     selector opts into corpus mode (github: content.mode === 'corpus'); the
+ *     root is the state-root repo cache populated by `construct sources sync`.
+ *     A corpus target with no cache yet resolves to nothing (nothing to index).
+ *
+ * Capability is keyed off manifest descriptors, never a hardcoded provider name,
+ * matching the registry pattern in lib/config/source-target-registry.mjs. Adding
+ * a future git-hosted content provider means declaring its manifest `content`
+ * block, not editing this file.
+ *
+ * Every root carries an `origin` — {targetId, provider, projectKey, ref} — which
+ * the corpus builders stamp onto each chunk (adding per-file `relPath`) so
+ * cross-project retrieval can attribute and filter results by source project.
+ * The host project itself is the reserved origin: targetId null, projectKey
+ * `self`. `--projects=self` selects it.
+ */
+
+import { statSync } from 'node:fs';
+import path from 'node:path';
+
+import { getSourceTargetDescriptor } from '../config/source-target-registry.mjs';
+import { expandTilde, resolveEffectiveSourceTargetsFromConfig } from '../config/source-targets.mjs';
+import { isCorpusTarget, corpusCacheDir, corpusFreshness } from './repo-cache.mjs';
+
+export const SELF_PROJECT_KEY = 'self';
+
+function isDirectoryTarget(target) {
+  const descriptor = getSourceTargetDescriptor(target?.provider);
+  return descriptor?.selector?.existsAs === 'directory';
+}
+
+/**
+ * Does this target declare any content capability at all (directory or corpus)?
+ * Expands `--projects=all` to the content-eligible target set.
+ */
+export function isContentCapableTarget(target) {
+  return isDirectoryTarget(target) || isCorpusTarget(target);
+}
+
+function directoryRoot(target) {
+  const descriptor = getSourceTargetDescriptor(target.provider);
+  const raw = target.selector?.[descriptor.selector.field];
+  if (!raw) return null;
+  const dir = expandTilde(String(raw));
+  try {
+    if (!statSync(dir).isDirectory()) return null;
+  } catch {
+    return null;
+  }
+  return { dir, ref: null };
+}
+
+function corpusRoot(target, projectRoot) {
+  const freshness = corpusFreshness(target, { projectRoot });
+  if (!freshness.cached) return null;
+  return { dir: corpusCacheDir(target, { projectRoot }), ref: freshness.ref ?? null };
+}
+
+/**
+ * Resolve content-capable targets to concrete on-disk roots. Targets whose
+ * content is not present (a directory that vanished, a corpus never synced) are
+ * silently omitted — there is nothing to index — so callers get only roots they
+ * can actually walk.
+ *
+ * @param {object[]} targets      effective source targets (post-merge)
+ * @param {object} [opts]
+ * @param {string} [opts.projectRoot]
+ * @returns {{dir: string, origin: {targetId: string, provider: string, projectKey: string, ref: string|null}}[]}
+ */
+export function resolveContentRoots(targets = [], { projectRoot = process.cwd() } = {}) {
+  const roots = [];
+  for (const target of targets) {
+    let resolved = null;
+    if (isDirectoryTarget(target)) resolved = directoryRoot(target);
+    else if (isCorpusTarget(target)) resolved = corpusRoot(target, projectRoot);
+    if (!resolved) continue;
+    roots.push({
+      dir: resolved.dir,
+      origin: {
+        targetId: target.id,
+        provider: target.provider,
+        projectKey: target.id,
+        ref: resolved.ref,
+      },
+    });
+  }
+  return roots;
+}
+
+/**
+ * Convenience wrapper: resolve content roots straight from a loaded project
+ * config (merging in legacy env targets exactly as the rest of the pipeline does).
+ */
+export function resolveContentRootsFromConfig(config, { projectRoot = process.cwd(), env = process.env } = {}) {
+  const targets = resolveEffectiveSourceTargetsFromConfig(config, env);
+  return resolveContentRoots(targets, { projectRoot });
+}
+
+/**
+ * Expand a `--projects=` / `projects` filter spec into the set of origin
+ * targetIds it selects. Accepts a CSV string or an array. Semantics:
+ *   - `all`  → every content-capable target id (host not included).
+ *   - `self` → the reserved host project key.
+ *   - a target id → that id, which must exist and be content-capable.
+ * An unknown or non-content-capable id is a hard error (never a silent empty
+ * result), per R3.
+ *
+ * @returns {{ ids: Set<string>, includeSelf: boolean }}
+ * @throws {Error} on an unknown id, with a message listing the known ids.
+ */
+export function expandProjectsFilter(spec, targets = []) {
+  const tokens = (Array.isArray(spec) ? spec : String(spec ?? '').split(','))
+    .map((s) => String(s).trim())
+    .filter(Boolean);
+
+  const contentTargets = targets.filter(isContentCapableTarget);
+  const knownById = new Map(contentTargets.map((t) => [t.id, t]));
+
+  const ids = new Set();
+  let includeSelf = false;
+
+  for (const token of tokens) {
+    if (token === 'all') {
+      for (const t of contentTargets) ids.add(t.id);
+      continue;
+    }
+    if (token === SELF_PROJECT_KEY) {
+      includeSelf = true;
+      continue;
+    }
+    if (!knownById.has(token)) {
+      const known = [SELF_PROJECT_KEY, 'all', ...knownById.keys()];
+      throw new Error(`unknown project "${token}" — known projects: ${known.join(', ')}`);
+    }
+    ids.add(token);
+  }
+
+  return { ids, includeSelf };
+}