@gethmy/harness 1.1.1 → 1.2.0

package/src/model-tier.test.ts

@@ -47,12 +47,9 @@ describe("chooseImplementModel", () => {
   it("honors a pinned override above everything (no escalation)", () => {
     const r = chooseImplementModel(
       claude,
-      card({
-        model_override: "claude-opus-4-8",
-        model_tier: "simple",
-        priority: "urgent",
-      }),
+      card({ model_override: "claude-opus-4-8", priority: "urgent" }),
       5,
+      { tier: "simple", complexity: 1 },
     );
     expect(r).toEqual({
       model: "claude-opus-4-8",
@@ -61,34 +58,81 @@ describe("chooseImplementModel", () => {
     });
   });
 
-  it("resolves a tier to its configured model on the first attempt", () => {
-    const r = chooseImplementModel(claude, card({ model_tier: "simple" }), 1);
+  it("resolves a tier-shaped override through the operator's own ladder", () => {
+    // The board now writes a TIER name, not a model id, so it stops
+    // duplicating the daemon's `claude.tiers` map. An operator who remaps a
+    // tier gets their own model, not the one the frontend guessed.
+    const r = chooseImplementModel(
+      claude,
+      card({ model_override: "research" }),
+      1,
+      { tier: "simple", complexity: 0 },
+    );
+    expect(r).toEqual({ model: "opus", escalated: false, source: "override" });
+  });
+
+  it("still resolves a legacy model-id override", () => {
+    // Cards pinned before the board switched to tier names must keep working.
+    const r = chooseImplementModel(
+      claude,
+      card({ model_override: "sonnet" }),
+      1,
+      { tier: "research", complexity: 9 },
+    );
+    expect(r).toEqual({
+      model: "sonnet",
+      escalated: false,
+      source: "override",
+    });
+  });
+
+  it("resolves the preflight tier to its configured model on the first attempt", () => {
+    const r = chooseImplementModel(claude, card({}), 1, {
+      tier: "simple",
+      complexity: 1,
+    });
     expect(r).toEqual({ model: "haiku", escalated: false, source: "tier" });
   });
 
-  it("escalates the tier up one level on a retry", () => {
-    const r = chooseImplementModel(claude, card({ model_tier: "simple" }), 2);
+  it("escalates the preflight tier up one level on a retry", () => {
+    const r = chooseImplementModel(claude, card({}), 2, {
+      tier: "simple",
+      complexity: 1,
+    });
     expect(r).toEqual({ model: "sonnet", escalated: true, source: "tier" });
   });
 
-  it("falls back to global policy when no tier/override is set", () => {
-    expect(chooseImplementModel(claude, card({}), 1)).toEqual({
+  it("falls back to global policy when the preflight produced nothing", () => {
+    // This is the degradation contract: a preflight that failed, timed out, or
+    // was disabled must leave behaviour exactly as it was before it existed.
+    expect(chooseImplementModel(claude, card({}), 1, undefined)).toEqual({
       model: "opus",
       escalated: false,
       source: "policy",
     });
-    expect(chooseImplementModel(claude, card({}), 2)).toEqual({
+    expect(chooseImplementModel(claude, card({}), 2, undefined)).toEqual({
       model: "claude-opus-4-8",
       escalated: true,
       source: "policy",
     });
-    expect(chooseImplementModel(claude, card({ priority: "high" }), 1)).toEqual(
-      { model: "claude-opus-4-8", escalated: true, source: "policy" },
+    expect(
+      chooseImplementModel(claude, card({ priority: "high" }), 1, undefined),
+    ).toEqual({ model: "claude-opus-4-8", escalated: true, source: "policy" });
+  });
+
+  it("ignores card.model_tier entirely", () => {
+    // The column still exists and still holds stale values written by the
+    // retired create-time classifier. Nothing may read it.
+    const r = chooseImplementModel(
+      claude,
+      card({ model_tier: "research" }),
+      1,
+      undefined,
     );
+    expect(r).toEqual({ model: "opus", escalated: false, source: "policy" });
   });
 
   it("spawns Fable 5 unclamped now that it is available again (#747)", () => {
-    // Pinned override.
     expect(
       chooseImplementModel(
         claude,
@@ -101,7 +145,6 @@ describe("chooseImplementModel", () => {
       source: "override",
     });
 
-    // Global policy escalation (the shipped default).
     const fableEscalate = { ...claude, escalateModel: "claude-fable-5" };
     expect(chooseImplementModel(fableEscalate, card({}), 2)).toEqual({
       model: "claude-fable-5",
@@ -109,7 +152,6 @@ describe("chooseImplementModel", () => {
       source: "policy",
     });
 
-    // Tier mapping.
     const fableTier = {
       ...claude,
       tiers: {
@@ -119,13 +161,14 @@ describe("chooseImplementModel", () => {
       },
     };
     expect(
-      chooseImplementModel(fableTier, card({ model_tier: "research" }), 1)
-        .model,
+      chooseImplementModel(fableTier, card({}), 1, {
+        tier: "research",
+        complexity: 9,
+      }).model,
     ).toBe("claude-fable-5");
   });
 
   it("clamps a retired model id up to the ceiling from any source", () => {
-    // Pinned override naming a retired model.
     expect(
       chooseImplementModel(
         claude,
@@ -138,7 +181,6 @@ describe("chooseImplementModel", () => {
       source: "override",
     });
 
-    // Stale config still pointing escalateModel at a retired model.
     const staleConfig = { ...claude, escalateModel: "claude-3-opus-20240229" };
     expect(chooseImplementModel(staleConfig, card({}), 2)).toEqual({
       model: MAX_IMPLEMENT_MODEL,
@@ -146,13 +188,25 @@ describe("chooseImplementModel", () => {
       source: "policy",
     });
 
-    // Tier mapping pointing at a retired model.
     const retiredTier = {
       ...claude,
       tiers: { simple: "claude-2.1", advanced: "sonnet", research: "opus" },
     };
     expect(
-      chooseImplementModel(retiredTier, card({ model_tier: "simple" }), 1)
+      chooseImplementModel(retiredTier, card({}), 1, {
+        tier: "simple",
+        complexity: 1,
+      }).model,
+    ).toBe(MAX_IMPLEMENT_MODEL);
+  });
+
+  it("clamps a retired model behind a tier-shaped override too", () => {
+    const retiredTier = {
+      ...claude,
+      tiers: { simple: "claude-2.1", advanced: "sonnet", research: "opus" },
+    };
+    expect(
+      chooseImplementModel(retiredTier, card({ model_override: "simple" }), 1)
         .model,
     ).toBe(MAX_IMPLEMENT_MODEL);
   });
@@ -160,10 +214,20 @@ describe("chooseImplementModel", () => {
   it("falls back to base model if a tier has no configured mapping", () => {
     const r = chooseImplementModel(
       { ...claude, tiers: { simple: "", advanced: "", research: "" } },
-      card({ model_tier: "research" }),
+      card({}),
       1,
+      { tier: "research", complexity: 9 },
     );
     expect(r.model).toBe("opus");
     expect(r.source).toBe("tier");
   });
+
+  it("falls back to base model for a tier-shaped override with no mapping", () => {
+    const r = chooseImplementModel(
+      { ...claude, tiers: { simple: "", advanced: "", research: "" } },
+      card({ model_override: "research" }),
+      1,
+    );
+    expect(r).toEqual({ model: "opus", escalated: false, source: "override" });
+  });
 });

package/src/model-tier.ts

@@ -1,4 +1,4 @@
-import type { Card } from "@harmony/shared";
+import type { Card, ModelTier } from "@harmony/shared";
 import { escalateTier, isModelTier } from "@harmony/shared";
 
 /**
@@ -51,43 +51,73 @@ export function clampWithdrawn(model: string): string {
   return RETIRED_MODEL.test(model) ? MAX_IMPLEMENT_MODEL : model;
 }
 
+/** What the pickup preflight decided, when it ran and produced a verdict. */
+export interface RunSizing {
+  tier: ModelTier;
+  /** 0-10, as the preflight scored it. Carried for the trace, not for routing. */
+  complexity: number;
+  /** One sentence explaining the score. */
+  reasoning?: string;
+  /** Paths the preflight read to reach the score. */
+  filesInspected?: string[];
+}
+
 /**
  * Pick the model for an implement run.
  *
- * Precedence (#354):
- *   1. `card.model_override` — a user-pinned concrete model id. Always wins,
- *      never auto-escalates (the user chose it deliberately).
- *   2. `card.model_tier` — the classifier's suggested tier, resolved through
- *      `claude.tiers`. On a retry (attempts >= escalateAfterAttempts) the tier
- *      bumps up one level before resolving.
- *   3. Global policy fallback — the original #348 behaviour: escalate to
- *      `escalateModel` on high/urgent priority or on a retry, else `model`.
+ * Precedence:
+ *   1. `card.model_override` — a human pin. Always wins, never auto-escalates
+ *      (the user chose it deliberately). Accepts either a TIER NAME, which the
+ *      board writes now, or a concrete model id, which it wrote before. A tier
+ *      resolves through the operator's own `claude.tiers`, so the board no
+ *      longer has to duplicate — and guess at — the daemon's ladder.
+ *   2. `sized.tier` — the pickup preflight. On a retry (attempts >=
+ *      escalateAfterAttempts) the tier bumps one level before resolving.
+ *
+ *      This replaces the retired `card.model_tier`, which a create-time
+ *      classifier wrote by guessing engineering effort from a title composed
+ *      before anyone had looked at the code. The preflight runs at pickup with
+ *      the repo readable, so the answer is measured rather than guessed — and
+ *      it is run-scoped, so a stale value can never outlive the run it was for.
+ *      `card.model_tier` is deliberately NOT read here; the column survives
+ *      only so old rows stay readable until a follow-up drops it.
+ *   3. Global policy fallback — escalate on high/urgent priority or on a retry.
+ *      This is also where EVERY preflight failure lands (spawn error, timeout,
+ *      malformed output, or an operator who disabled it), so a broken preflight
+ *      degrades to exactly the behaviour that shipped before it existed.
  *
- * Whichever path wins, the result is clamped to {@link MAX_IMPLEMENT_MODEL}:
- * a retired model id is never spawned regardless of its source.
+ * Whichever path wins, the result is clamped to {@link MAX_IMPLEMENT_MODEL}: a
+ * retired model id is never spawned regardless of its source.
  *
  * Pure so the policy is unit-testable without spawning a worker.
  */
 export function chooseImplementModel(
   claude: ModelTierConfig,
-  card: Pick<Card, "priority" | "model_tier" | "model_override">,
+  card: Pick<Card, "priority" | "model_override">,
   attempts: number,
+  sized?: RunSizing,
 ): {
   model: string;
   escalated: boolean;
   source: "override" | "tier" | "policy";
 } {
   if (card.model_override) {
+    // A tier name resolves through the operator's ladder; anything else is
+    // taken as a concrete model id. An unmapped tier falls back to the base
+    // model rather than spawning the empty string.
+    const pinned = isModelTier(card.model_override)
+      ? claude.tiers?.[card.model_override] || claude.model
+      : card.model_override;
     return {
-      model: clampWithdrawn(card.model_override),
+      model: clampWithdrawn(pinned),
       escalated: false,
       source: "override",
     };
   }
 
-  if (isModelTier(card.model_tier)) {
+  if (sized && isModelTier(sized.tier)) {
     const retry = attempts >= claude.escalateAfterAttempts;
-    const tier = retry ? escalateTier(card.model_tier) : card.model_tier;
+    const tier = retry ? escalateTier(sized.tier) : sized.tier;
     const mapped = claude.tiers?.[tier];
     return {
       model: clampWithdrawn(

package/src/motor-stream.ts

@@ -0,0 +1,120 @@
+/**
+ * The motor's LIVE stdout relay for its subagent (card #885).
+ *
+ * The motor runs a real, token-spending `claude` subagent, and until this
+ * module existed nothing about that run left the motor process: `cli.ts` logged
+ * each event at `log.debug` (dropped unless `DEBUG` is set) and the driver saw
+ * only the four coarse protocol lines, all at the very end. A live run and a
+ * hung run were therefore identical to a human — measured on card #906, stdout
+ * held 0 bytes for 9 minutes and then produced 4 lines at once.
+ *
+ * A relayed event is the SAME `AgentRunEventDraft` the daemon's own
+ * `ProgressTracker.ingest` already consumes on the in-process path, so the
+ * driver needs no second vocabulary: it feeds the draft straight in and the
+ * board's turns, tokens, cost, tool actions and progress come out identical to
+ * a non-motor run.
+ *
+ * Two deliberate narrowings, because this crosses a process boundary:
+ *
+ *  1. An ALLOW-set of kinds, never a deny-set. The daemon owns the lifecycle
+ *     kinds (`phase_changed`, `progress`, `control`, `user_message`) — relaying
+ *     them would let the motor fight its own driver for the session row — and a
+ *     kind added to the union later must be opted in here, not leak by default.
+ *  2. `tool_started.input` is BOUNDED. It is the one payload the SDK runner
+ *     hands over whole: a `Write` of a 200 KB file would otherwise cross the
+ *     pipe in full, on every tool call. Only top-level primitives survive, each
+ *     string clipped — which is exactly and only what the tracker reads back
+ *     out (`describeToolAction` → `extractString`, top-level string keys).
+ */
+import type { AgentRunEventDraft } from "@harmony/shared";
+
+/** One relayed subagent event on the motor's NDJSON stdout. */
+export interface MotorAgentEventLine {
+  type: "agent_event";
+  event: AgentRunEventDraft;
+}
+
+/**
+ * Kinds the motor relays to its driver. `assistant_text` and `tool_ended` are
+ * already bounded by the SDK runner (8 KB / 4 KB); the rest are small by shape.
+ */
+const RELAYED_KINDS = new Set<AgentRunEventDraft["kind"]>([
+  "run_started",
+  "assistant_text",
+  "tool_started",
+  "tool_ended",
+  "cost_updated",
+  "error",
+  "run_finished",
+]);
+
+/** Per-string clip inside a relayed `tool_started.input`. */
+export const MOTOR_TOOL_INPUT_VALUE_MAX = 400;
+
+/**
+ * Key cap for a relayed `tool_started.input`. A tool schema with more top-level
+ * keys than this is not something the tracker reads, and the cap keeps one
+ * malformed input from dominating the pipe.
+ */
+export const MOTOR_TOOL_INPUT_KEY_MAX = 24;
+
+/**
+ * Reduce a tool input to the top-level primitives a consumer can actually read
+ * back, with every string clipped. Nested objects and arrays are dropped: the
+ * tracker's `extractString` only ever resolves a top-level key, so a nested
+ * value carries no information downstream and is pure pipe weight.
+ */
+function boundToolInput(input: unknown): unknown {
+  if (typeof input === "string") {
+    return input.slice(0, MOTOR_TOOL_INPUT_VALUE_MAX);
+  }
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    // A primitive is already small; anything else (array, null, undefined)
+    // carries no top-level key a consumer could read.
+    return typeof input === "number" || typeof input === "boolean"
+      ? input
+      : undefined;
+  }
+  const bounded: Record<string, unknown> = {};
+  let kept = 0;
+  for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
+    if (kept >= MOTOR_TOOL_INPUT_KEY_MAX) break;
+    // The KEY is clipped as well as the value. A tool schema's key names are
+    // normally short, but nothing guarantees it — and 24 unbounded keys would
+    // make "bounded" untrue by exactly the amount an adversarial input chose.
+    const boundedKey = key.slice(0, MOTOR_TOOL_INPUT_VALUE_MAX);
+    if (typeof value === "string") {
+      bounded[boundedKey] = value.slice(0, MOTOR_TOOL_INPUT_VALUE_MAX);
+    } else if (typeof value === "number" || typeof value === "boolean") {
+      bounded[boundedKey] = value;
+    } else {
+      continue;
+    }
+    kept++;
+  }
+  return bounded;
+}
+
+/**
+ * Project one subagent event onto the motor's stdout protocol, or `null` when
+ * the kind is not relayed. Never mutates the draft it is given — the motor's own
+ * logging reads the original afterwards.
+ */
+export function relayAgentEvent(
+  draft: AgentRunEventDraft,
+): MotorAgentEventLine | null {
+  if (!RELAYED_KINDS.has(draft.kind)) return null;
+  if (draft.kind === "tool_started") {
+    return {
+      type: "agent_event",
+      event: {
+        ...draft,
+        payload: {
+          ...draft.payload,
+          input: boundToolInput(draft.payload.input),
+        },
+      },
+    };
+  }
+  return { type: "agent_event", event: draft };
+}

package/src/oracle-collector.ts

@@ -21,6 +21,7 @@
  * deliberately: it is not a secrecy gate, and its output is exactly what a human
  * needs to see. Do not "make them consistent."
  */
+import { createHash } from "node:crypto";
 import type {
   GateEvidence,
   GateEvidenceCollector,
@@ -56,6 +57,15 @@ export class OracleCollector implements GateEvidenceCollector {
   }
 
   private async runHeld(oracle: HeldOracle): Promise<GateEvidence> {
+    // The identity of the contract this verdict proves (card #927): two
+    // authors can pick the same path, but not the same digest — and a digest
+    // leaks nothing of the held test, so it survives the secrecy rule. The
+    // edge computes the same SHA-256 (lowercase hex) when it records a
+    // replacement, so evidence and replacement record can be matched.
+    const identity = {
+      oracleId: oracle.id ?? null,
+      contentHash: createHash("sha256").update(oracle.content).digest("hex"),
+    };
     await this.deps.place(this.deps.repoPath, oracle);
     try {
       const { exitCode, output } = await this.deps.run(
@@ -77,6 +87,7 @@ export class OracleCollector implements GateEvidenceCollector {
           oracle: {
             exitCode,
             path: oracle.path,
+            ...identity,
             output:
               "withheld — oracle_passed is a secrecy gate; see the motor's local log",
           },
@@ -87,7 +98,10 @@ export class OracleCollector implements GateEvidenceCollector {
       log.warn(TAG, `Oracle run threw: ${message} — blocked`);
       return {
         result: "blocked",
-        structured: { oracle: { path: oracle.path }, error: message },
+        structured: {
+          oracle: { path: oracle.path, ...identity },
+          error: message,
+        },
       };
     } finally {
       // Always. A held test left in the worktree could be committed, which would

package/src/oracle.ts

@@ -70,6 +70,13 @@ import { DEFAULT_METRIC_TIMEOUT_MS } from "./exec-types.js";
 import { reapGroup, spawnInGroup, terminateGroup } from "./process-group.js";
 
 export interface HeldOracle {
+  /**
+   * The `stage_oracles` row id, when the API returns one (card #927 — older
+   * deployments answer without it). It rides into the gate's persisted
+   * evidence beside the content digest, so a verdict is traceable to the
+   * exact contract it graded.
+   */
+  id?: string | null;
   path: string;
   content: string;
   runnerHint: string | null;