@getpipher/armory-fleet 0.13.0 → 0.15.0

package/README.md

@@ -123,22 +123,22 @@ export const meta = {
 }
 
 phase('Plan')
-const plan = await agent('Plan this feature: ' + args.task, { tier: 'low' })
+const plan = await agent('Plan this feature: ' + args.task, { tier: 'economy' })
 
 phase('Implement')
-const impl = await agent(`Implement the plan:\n${plan}`, { tier: 'medium' })
+const impl = await agent(`Implement the plan:\n${plan}`, { tier: 'standard' })
 
 phase('Review')
 const angles = ['security', 'performance', 'correctness']
 const reviews = await parallel(
-  angles.map((a) => () => agent(`Review the implementation for ${a} issues.`, { tier: 'low' })),
+  angles.map((a) => () => agent(`Review the implementation for ${a} issues.`, { tier: 'economy' })),
 )
 
 // gate: revise the synthesis until it passes a validator
 const synthesis = await gate(
   async (_feedback, n) => n === 0
-    ? agent(`Synthesize ${reviews.length} reviews.`, { tier: 'low' })
-    : agent('Revise synthesis per feedback.', { tier: 'low' }),
+    ? agent(`Synthesize ${reviews.length} reviews.`, { tier: 'economy' })
+    : agent('Revise synthesis per feedback.', { tier: 'economy' }),
   (v) => typeof v === 'string' && v.length > 200 ? { ok: true } : { ok: false, feedback: 'more detail' },
   { attempts: 3 },
 )
@@ -236,9 +236,21 @@ Composite helpers (`src/workflows/helpers/`) — usable from any workflow:
 
 | Tier | Models | Cost cap | Context floor |
 |---|---|---|---|
-| `economy` | `Ollama/minimax-m3:cloud` | — | — |
-| `standard` | `Ollama/glm-5.2:cloud`, `Ollama/minimax-m3:cloud` | — | — |
-| `frontier` | `anthropic/claude-sonnet-4`, `Ollama/glm-5.2:cloud` | $5 | 200k ctx |
+| `economy` | `inherit` | — | — |
+| `standard` | `inherit` | — | — |
+| `frontier` | `inherit` | — | 200k ctx |
+
+The shipped defaults use the **`inherit` sentinel** — each tier resolves to your **active session model**, so tier routing works on any provider out of the box. To route across models, override a tier by name with a concrete `provider/id` chain in `~/.pi/agent/fleet/tiers.json` (global) or `<project>/.pi/fleet/tiers.json` (project):
+
+```json
+[
+  { "name": "economy",  "models": ["Ollama/minimax-m3:cloud"] },
+  { "name": "standard", "models": ["Ollama/glm-5.2:cloud", "inherit"] },
+  { "name": "frontier", "models": ["anthropic/claude-sonnet-4"], "costCap": 5, "contextFloor": 200000 }
+]
+```
+
+Models are an ordered fallback chain (primary first; a spawn retries the next candidate if model creation is rejected); the `inherit` sentinel (case-insensitive) may appear anywhere in the chain as a provider-agnostic fallback and always resolves to the session model without catalog or floor checks. `contextFloor` skips catalog models below the window size; `costCap` aborts a run whose live cost exceeds the cap (a no-op on flat subscriptions). Tier routing applies to pi-backend agents — `backend: "claude"` agents receive the resolved string via `--model` and the claude CLI expects its own model names, so route those by `model:` instead.
 
 Live cost $ and context % are tracked per run and surfaced in the Tiers view. Override per-run with `model`, or let the tier registry route based on the task class.
 
@@ -316,6 +328,25 @@ Every workflow run is **journaled** (`workflows/journal.ts`) and **resumable**.
 - **Panel Run-action:** a 3rd `cwd` input step (task → name → cwd), prefilled with the session cwd; Enter accepts, Escape cancels.
 - **Deferred:** bg/scheduled + worktree cwd-isolation (the `cwd` param is honored by foreground dispatches only for now) — tracked in #62.
 
+## Provider-agnostic tiers (v0.15.0)
+
+Small-backlog batch (issues #57/#63/#64/#65):
+
+- **Tier `inherit` sentinel (#64)** — builtin tiers no longer hardcode a provider: `economy`/`standard`/`frontier` now resolve to your **active session model** out of the box (frontier keeps its 200k context floor; the $5 cost cap moved to the override example — a no-op on flat subs). Override by name in `tiers.json` with concrete `provider/id` chains for real multi-model routing; `inherit` can appear mid-chain as a provider-agnostic fallback. See [Cost-aware tiers](#cost-aware-tiers).
+- **Self-correcting model errors (#57)** — dispatching with a model the runtime doesn't have now lists the session's available (authed) models in the error, so the orchestrating model can pick a valid one on the retry instead of guessing.
+- **Panel Escape semantics documented + dead code removed (#63)** — Escape always cancels the active panel flow; defaults are accepted via Enter-on-blank. (Also fixed: ctrl+c could trigger the never-documented "escape accepts default" callbacks.)
+- **README example tier names fixed (#65)** — the `ship-feature` example now uses real tier names (`economy`/`standard`).
+
+## Dogfood reliability (v0.14.0)
+
+Four fixes from dogfooding the fleet on itself (issues #58–#61):
+
+- **`ARMORY_FLEET_MODEL_FALLBACK=auto`** — resolve the global fallback per session from the configured+available model snapshot: a different **provider** than the session model is preferred, else a different model id; unresolvable (single-model setup) stays off with a one-time warning. Non-`auto` env values are used verbatim; per-dispatch `modelFallback` still wins.
+- **No-fallback hint** — a retryable provider failure (stopReason `error`) with neither a per-dispatch `modelFallback` nor the global default surfaces `no modelFallback configured — pass modelFallback or set ARMORY_FLEET_MODEL_FALLBACK` so silent no-retry failures are visible.
+- **Masked primary errors fixed** — when a fallback retry also fails, the surfaced error now names **both** attempts (`primary '<model>' failed: …; fallback '<model>' failed: …`) instead of only the fallback's.
+- **Zero-tool-call flag (#61)** — a run that "completes" without a single executed tool call (the premature-return shape: narrate a plan, end) is prefixed with `[FLEET] zero-tool-call run — likely a premature return` in the tool result; `details.toolCallCount` exposes the count. Verify (git status/log) before trusting such a result.
+- **Richer run journal** — `run:ended` now carries `error` (failure reason), `filesTouched` (#49 parity in the durable journal — real SDK args are captured from `tool_execution_start`; the end event has none), and `toolCallCount`.
+
 ## Roadmap
 
 armory-fleet follows a PRD → SPEC-N (brainstorm → spec → plan → implementation) pipeline. **16/16 phases done through v0.12.0.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpipher/armory-fleet",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "private": false,
   "description": "The armory suite's subagent orchestrator for the pi coding agent — a cross-harness, superpowers-native fleet where every agent is armory-native from birth.",
   "license": "MIT",

package/src/backend/claude-events.ts

@@ -1,39 +1,58 @@
-// src/backend/claude-events.ts — map one CC stream-json NDJSON line → ChildSessionEvent (SPEC-3 §4.2).
+// src/backend/claude-events.ts — map one CC stream-json NDJSON line → ChildSessionEvent(s) (SPEC-3 §4.2).
 // Returns null for: filtered echoes (our own user writes), unknown types, malformed lines.
 // The caller logs null-but-parseable lines at debug (forward-compat: CC may add types we don't need).
 import type { ChildSessionEvent } from "../engine/spawnSubagent.ts";
 
-interface CCMessage { role?: string; content?: Array<{ type: string; text?: string }>; usage?: Record<string, unknown>; }
+interface CCContentBlock { type: string; text?: string; id?: string; name?: string; input?: Record<string, unknown>; }
+interface CCMessage { role?: string; content?: CCContentBlock[]; usage?: Record<string, unknown>; }
 interface CCEvent { type: string; subtype?: string; session_id?: string; message?: CCMessage; error?: { message?: string }; }
 
-export function mapClaudeEvent(line: string): ChildSessionEvent | null {
+/** Map one line to ALL the ChildSessionEvents it implies. An assistant message carrying tool_use
+ *  blocks yields the message_end PLUS one tool_execution_end per block (#61: the engine's
+ *  zero-tool-call premature-return signal must count claude children too — without this, every
+ *  completed claude run counted 0 tools and was falsely flagged). The per-block end event fires
+ *  at message time, not per-tool completion (CC stream-json gives no finer granularity) — right
+ *  enough for "did the child act", which is what the count is for. */
+export function mapClaudeEvents(line: string): ChildSessionEvent[] {
   let ev: CCEvent;
   try {
     ev = JSON.parse(line) as CCEvent;
   } catch {
-    return null; // malformed line — resilient
+    return []; // malformed line — resilient
   }
   switch (ev.type) {
-    case "system":
+    case "system": {
       if (ev.subtype === "init" && typeof ev.session_id === "string") {
-        return { type: "session_init", backendSessionId: ev.session_id };
+        return [{ type: "session_init", backendSessionId: ev.session_id }];
       }
-      return null;
+      return [];
+    }
     case "assistant": {
       const msg = ev.message;
-      if (!msg) return null;
+      if (!msg) return [];
       const content = (msg.content ?? []).map((c) => ({ type: c.type, text: c.text }));
       const usage = msg.usage as { cost?: { total?: number } } | undefined;
-      return { type: "message_end", message: { role: msg.role ?? "assistant", content, usage } };
+      const events: ChildSessionEvent[] = [{ type: "message_end", message: { role: msg.role ?? "assistant", content, usage } }];
+      for (const block of msg.content ?? []) {
+        if (block.type === "tool_use") {
+          events.push({ type: "tool_execution_end", toolCallId: block.id ?? "", toolName: block.name ?? "unknown", args: block.input, result: "", isError: false });
+        }
+      }
+      return events;
     }
     case "result":
       // turn boundary (success or error_max_turns) → turn_end drives the budget
-      return { type: "turn_end" };
+      return [{ type: "turn_end" }];
     case "error":
-      return { type: "error", message: { role: "error", content: [{ type: "text", text: ev.error?.message ?? "claude error" }] } };
+      return [{ type: "error", message: { role: "error", content: [{ type: "text", text: ev.error?.message ?? "claude error" }] } }];
     case "user":
-      return null; // echo of our own stdin write — filtered
+      return []; // echo of our own stdin write — filtered
     default:
-      return null; // unknown — forward-compat, caller logs at debug
+      return []; // unknown — forward-compat, caller logs at debug
   }
+}
+
+/** Single-event compat wrapper (claude-detector + existing consumers read one event per line). */
+export function mapClaudeEvent(line: string): ChildSessionEvent | null {
+  return mapClaudeEvents(line)[0] ?? null;
 }

package/src/backend/claude-session.ts

@@ -2,7 +2,7 @@
 import type { ChildProcess } from "node:child_process";
 import { createInterface } from "node:readline";
 import type { ChildSession, ChildSessionEvent } from "../engine/spawnSubagent.ts";
-import { mapClaudeEvent } from "./claude-events.ts";
+import { mapClaudeEvents } from "./claude-events.ts";
 import type { ResumeStore } from "./resume-store.ts";
 
 export class ClaudeChildSession implements ChildSession {
@@ -24,16 +24,16 @@ export class ClaudeChildSession implements ChildSession {
   }
 
   private onLine(line: string): void {
-    const ev = mapClaudeEvent(line);
-    if (!ev) return;
-    if (ev.type === "session_init" && ev.backendSessionId && !this.initCaptured) {
-      this.initCaptured = true;
-      this.resumeStore.set("claude", this.sessionKey, ev.backendSessionId);
+    for (const ev of mapClaudeEvents(line)) {
+      if (ev.type === "session_init" && ev.backendSessionId && !this.initCaptured) {
+        this.initCaptured = true;
+        this.resumeStore.set("claude", this.sessionKey, ev.backendSessionId);
+      }
+      if (ev.type === "turn_end" || ev.type === "error") {
+        if (this.turnResolve) { this.turnResolve(); this.turnResolve = null; }
+      }
+      for (const h of this.handlers) h(ev);
     }
-    if (ev.type === "turn_end" || ev.type === "error") {
-      if (this.turnResolve) { const r = this.turnResolve; this.turnResolve = null; r(); }
-    }
-    for (const h of this.handlers) h(ev);
   }
 
   async prompt(text: string): Promise<void> {

package/src/engine/auto-fallback.ts

@@ -0,0 +1,19 @@
+// src/engine/auto-fallback.ts
+// #58: resolve the ARMORY_FLEET_MODEL_FALLBACK=auto sentinel — pick a fallback model from the
+// runtime's configured+available snapshot without the operator naming one. Prefers a model from
+// a DIFFERENT provider than the session model (a real fallback family, per the "Ollama primary +
+// OpenRouter fallback" pattern the feature was named for); if every available model shares the
+// session's provider, a different model id on that provider. undefined when nothing differs
+// (single-model setups) — the caller keeps auto-retry off and surfaces why.
+
+export function resolveAutoFallback(
+  available: ReadonlyArray<{ provider: string; id: string }>,
+  parentModel: { provider: string; id: string },
+): string | undefined {
+  const parentProvider = parentModel.provider || "";
+  const parentKey = `${parentModel.provider}/${parentModel.id}`;
+  const differentProvider = available.filter((m) => m.provider !== parentProvider);
+  const pool = differentProvider.length > 0 ? differentProvider : available;
+  const pick = pool.find((m) => `${m.provider}/${m.id}` !== parentKey);
+  return pick ? `${pick.provider}/${pick.id}` : undefined;
+}

package/src/engine/retry-fallback.ts

@@ -19,7 +19,14 @@ export function withModelFallbackRetry(spawn: SpawnFn, fallback: string | undefi
   return async (opts) => {
     const first = await spawn(opts);
     if (first.status === "failed" && first.retryable && fallback !== first.model && !signal?.aborted) {
-      return spawn({ ...opts, model: fallback });
+      const second = await spawn({ ...opts, model: fallback });
+      // #59: when the fallback also fails, compose the primary's failure into the surfaced error
+      // (same contract as the direct-foreground path in tools/subagent.ts) — the fallback's error
+      // alone masks why the primary failed.
+      if (second.status === "failed" && first.error && first.error !== second.error) {
+        second.error = `primary '${first.model}' failed: ${first.error}; fallback '${fallback}' failed: ${second.error ?? second.status}`;
+      }
+      return second;
     }
     return first;
   };

package/src/engine/spawnSubagent.ts

@@ -44,6 +44,13 @@ export interface ChildSessionEvent {
   };
   /** Emitted by a backend on session init (SPEC-3). Drives runRecord.backendSessionId. */
   backendSessionId?: string;
+  /** tool_execution_end fields (pi SDK native; claude mapper synthesizes from tool_use blocks, #61).
+   *  Consumers currently cast — these make the real shape type-visible. */
+  toolCallId?: string;
+  toolName?: string;
+  args?: unknown;
+  result?: unknown;
+  isError?: boolean;
 }
 
 export interface ChildSession {
@@ -182,6 +189,9 @@ export interface SpawnResult {
    *  or was it cut mid-tool-work? Surfaced on turn-budget exhaustion so the controller knows
    *  whether finalText is a partial summary or a mid-thought. Undefined for non-turn-budget paths. */
   reachedSummary?: boolean;
+  /** #61: number of executed tool calls. A "completed" run with 0 is the premature-return
+   *  shape (the child narrated and ended without acting) — the tool flags it in the result. */
+  toolCallCount?: number;
 }
 
 /** #49: extract file paths a tool event touched, for the structured partial-result report.
@@ -190,11 +200,13 @@ export interface SpawnResult {
 function extractTouchedFiles(toolName: string, args: unknown): string[] {
   if (!args || typeof args !== "object") return [];
   const a = args as Record<string, unknown>;
-  if (toolName === "edit" || toolName === "write") {
+  // Case-insensitive: pi tools are lowercase ("edit"), claude's are capitalized ("Edit").
+  const name = toolName.toLowerCase();
+  if (name === "edit" || name === "write") {
     const p = typeof a.path === "string" ? a.path : typeof a.file_path === "string" ? a.file_path : undefined;
     return p ? [p] : [];
   }
-  if (toolName === "bash") {
+  if (name === "bash") {
     const cmd = typeof a.command === "string" ? a.command : undefined;
     if (!cmd) return [];
     const out: string[] = [];
@@ -363,6 +375,12 @@ export async function spawnSubagent(opts: SpawnOptions): Promise<SpawnResult> {
     // a trailing assistant message after its last tool (a summary) vs being cut mid-tool-work.
     const filesTouched = new Set<string>();
     let sawAssistantAfterLastTool = true;   // no tools yet = trivially "reached a summary"
+    // #61: executed-tool count — a "completed" run with zero tool calls is the premature-return
+    // shape (read/narrate/end without acting); the tool flags it so the controller verifies.
+    let toolCallCount = 0;
+    // #60: args live on tool_execution_start (the SDK's end event carries none) — capture per
+    // toolCallId so extractTouchedFiles + the journal see the real args on real runs.
+    const pendingToolArgs = new Map<string, unknown>();
 
     // #23: liveness — classify events into a short, content-free class string for the widget.
     // Names the tool (safe — tool name is not args/result) so the operator sees "what's happening"
@@ -430,12 +448,20 @@ export async function spawnSubagent(opts: SpawnOptions): Promise<SpawnResult> {
           aborted = true;
           void session.abort();
         }
+      } else if (e.type === "tool_execution_start") {
+        pendingToolArgs.set((e as { toolCallId?: string }).toolCallId ?? "", (e as { args?: unknown }).args);   // #60
       } else if (e.type === "tool_execution_end") {
         // #49: track mutated files for the structured partial-result report.
+        toolCallCount += 1;   // #61
+        const toolCallId = (e as { toolCallId?: string }).toolCallId ?? "";
+        // #60: real args from the start event; `?? e.args` keeps hand-rolled fakes that put args
+        // on the end event working (the SDK never does).
+        const args = pendingToolArgs.get(toolCallId) ?? (e as { args?: unknown }).args;
+        pendingToolArgs.delete(toolCallId);
         sawAssistantAfterLastTool = false;   // cut mid-tool-work unless a message follows
-        for (const f of extractTouchedFiles((e as { toolName?: string }).toolName ?? "", (e as { args?: unknown }).args)) filesTouched.add(f);
+        for (const f of extractTouchedFiles((e as { toolName?: string }).toolName ?? "", args)) filesTouched.add(f);
         try {
-          opts.runLog?.append(runId, buildToolEvent((e as any).toolName, (e as any).args, (e as any).result, (e as any).isError ?? false, turnIdx));
+          opts.runLog?.append(runId, buildToolEvent((e as any).toolName, args, (e as any).result, (e as any).isError ?? false, turnIdx));
         } catch { /* best-effort */ }
       }
       // #23: liveness heartbeat — update the run record on meaningful events so the fleet widget
@@ -524,7 +550,7 @@ export async function spawnSubagent(opts: SpawnOptions): Promise<SpawnResult> {
       status = "completed";
     }
 
-    return await finishRun(opts, runId, startedAt, status, finalText, todoId, priorStatus, error, agentDef.name, model, tokenTotal, costTotal, contextTokens, modelError ? true : undefined, filesTouchedList, reachedSummary);
+    return await finishRun(opts, runId, startedAt, status, finalText, todoId, priorStatus, error, agentDef.name, model, tokenTotal, costTotal, contextTokens, modelError ? true : undefined, filesTouchedList, reachedSummary, toolCallCount);
   } finally {
     // #31: a readOnly dispatch never acquired the lock — don't release what it didn't take
     // (releasing a lock held by another concurrent write dispatch would corrupt serialization).
@@ -547,7 +573,7 @@ async function finishRun(
   status: FleetRunStatus, finalText: string, todoId: string | null, priorStatus: string | undefined,
   error: string | undefined, agentName: string, model: string, tokenTotal = 0, costTotal = 0, contextTokens = 0,
   retryable?: boolean,
-  filesTouched?: string[], reachedSummary?: boolean,
+  filesTouched?: string[], reachedSummary?: boolean, toolCallCount = 0,
 ): Promise<SpawnResult> {
   if (finalizedRunIds.has(runId)) {
     // Already finalized — return the existing registry record's result without re-appending.
@@ -557,7 +583,7 @@ async function finishRun(
       runId, todoId, agent: agentName, model,
       durationMs: existing?.endedAt ? existing.endedAt - startedAt : Date.now() - startedAt,
       tokenTotal, costTotal, contextTokens, error, retryable,
-      filesTouched, reachedSummary,
+      filesTouched, reachedSummary, toolCallCount,
     };
   }
   finalizedRunIds.add(runId);
@@ -574,6 +600,13 @@ async function finishRun(
       type: "run:ended", runId, status, endedAt,
       resultSummary: finalText.slice(0, 120), tokenTotal, costTotal, contextTokens,
       resumedFrom: opts.resumeLink, forkedFrom: opts.forkLink,
+      // #59: journal the failure reason — the archived failing runs had run:ended with an empty
+      // resultSummary and no error field, making post-hoc diagnosis from the journal impossible.
+      error,
+      // #61: executed-tool count (the zero-work premature-return signal, post-hoc too).
+      toolCallCount,
+      // #60: what the run mutated (was only on the SpawnResult; the durable journal lacked it).
+      filesTouched,
     });
   } catch { /* best-effort: journal is the index, not the product */ }
   // SPEC-4: lifecycle phase children skip the per-run todo reconciliation — the lifecycle
@@ -592,6 +625,6 @@ async function finishRun(
   return {
     status, finalText, runId, todoId, agent: agentName, model,
     durationMs: endedAt - startedAt, tokenTotal, costTotal, contextTokens, error, retryable,
-    filesTouched, reachedSummary,
+    filesTouched, reachedSummary, toolCallCount,
   };
 }

package/src/index.ts

@@ -18,6 +18,7 @@ import { ArmoryMemoryAdapter } from "./memory-hydrate/adapter.ts";
 import { ArmoryVisionAdapter } from "./vision/adapter.ts";
 import { buildChildLoader } from "./engine/child-loader.ts";
 import { withModelFallbackRetry } from "./engine/retry-fallback.ts";
+import { resolveAutoFallback } from "./engine/auto-fallback.ts";
 import { createDescribeImageTool } from "./vision/describe-image-tool.ts";
 import type { MemoryHydratePort } from "./memory-hydrate/port.ts";
 import type { VisionPort } from "./vision/port.ts";
@@ -108,6 +109,26 @@ async function buildDefaultBackendRegistry(modelRuntime: ModelRuntime): Promise<
   return reg;
 }
 
+/**
+ * Format the runtime's available models for the #57 self-correcting error message:
+ * dedup `provider/id` pairs, cap the list (min 1 — a non-empty input always lists
+ * something), actionable hint when empty.
+ */
+export function formatAvailableModels(models: readonly { provider: string; id: string }[], cap = 12): string {
+  const effectiveCap = Math.max(1, cap);
+  const seen = new Set<string>();
+  const list: string[] = [];
+  for (const m of models) {
+    const ref = `${m.provider}/${m.id}`;
+    if (seen.has(ref)) continue;
+    seen.add(ref);
+    if (list.length < effectiveCap) list.push(ref);
+  }
+  if (list.length === 0) return "(none — check provider auth / models.json)";
+  const omitted = seen.size - list.length;
+  return list.join(", ") + (omitted > 0 ? ` … +${omitted} more` : "");
+}
+
 export function createChildSessionFactory(modelRuntime: ModelRuntime, memoryPort: MemoryHydratePort, resumeStore: ResumeStore): ChildSessionFactory {
   return {
     async create(opts) {
@@ -118,7 +139,13 @@ export function createChildSessionFactory(modelRuntime: ModelRuntime, memoryPort
         const provider = opts.model.slice(0, slash);
         const id = opts.model.slice(slash + 1);
         model = modelRuntime.getModel(provider, id);
-        if (!model) throw new Error(`agent model '${opts.model}' not found in runtime (provider '${provider}', id '${id}')`);
+        // #57: name what IS usable so the orchestrating model can self-correct on retry.
+        if (!model) {
+          throw new Error(
+            `agent model '${opts.model}' not found in runtime (provider '${provider}', id '${id}'). ` +
+            `Available: ${formatAvailableModels(modelRuntime.getAvailableSnapshot())} — pick one of these for the model param`,
+          );
+        }
       }
       // Fleet CustomResourceLoader: noExtensions + composed systemPromptOverride (rolePrompt + memory + base) + scoped skills.
       const loader = buildChildLoader({ cwd: opts.cwd, agent: opts.agent, memoryPort });
@@ -204,7 +231,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
   // #39 tail: global default fallback model (env-driven for now; a settings.json field is a follow-up).
   // A retryable provider failure (stopReason "error") retries once on this model even without a
   // per-dispatch `modelFallback`. Per the AGENTS.md "Ollama primary + OpenRouter fallback" pattern.
-  deps.defaultModelFallback = process.env.ARMORY_FLEET_MODEL_FALLBACK || undefined;
+  // #39 tail + #58: the global default fallback. Non-"auto" env values are used verbatim;
+  // "auto" is resolved per-session in session_start (it needs the session model to differ from).
+  const rawModelFallback = process.env.ARMORY_FLEET_MODEL_FALLBACK || undefined;
+  deps.defaultModelFallback = rawModelFallback === "auto" ? undefined : rawModelFallback;
   // SPEC-6-5: cross-cwd dispatch notify hook (wired per-session in session_start below).
   // Placeholder; the real wiring happens in session_start where ctx is in scope.
 
@@ -309,6 +339,15 @@ export default async function (pi: ExtensionAPI): Promise<void> {
     refreshLifecycles(ctx);
     const m = ctx.model;
     deps.parentModel = m ? { provider: m.provider, id: m.id } : { provider: "", id: "" };
+    // #58: ARMORY_FLEET_MODEL_FALLBACK=auto — pick a fallback from the configured+available
+    // snapshot that differs from the session model (different provider preferred). Unresolvable
+    // (single-model setup) → stay off + say why once per session.
+    if (rawModelFallback === "auto") {
+      deps.defaultModelFallback = resolveAutoFallback(modelRuntime.getAvailableSnapshot(), deps.parentModel);
+      if (!deps.defaultModelFallback) {
+        ctx.ui.notify("ARMORY_FLEET_MODEL_FALLBACK=auto, but no alternative configured model is available — auto-retry stays off", "warning");
+      }
+    }
     deps.parentCwd = ctx.cwd;
     deps.onNotify = (m, k) => ctx.ui.notify(m, k ?? "info");
     // SPEC-5a: build the per-session async runner + scheduler, start firing, scan for interrupted runs.

package/src/panel/fleet-panel.ts

@@ -425,10 +425,8 @@ export class FleetPanel extends Container {
       this.linkInput.onSubmit = (todoIdRaw: string) => {
         void this.executeRun(agentName, task.trim(), todoIdRaw.trim() || undefined);
       };
-      this.linkInput.onEscape = () => { void this.executeRun(agentName, task.trim(), undefined); };
       this.renderShell();
     };
-    this.taskInput.onEscape = () => this.cancelRun();
     this.runMode = true;
     this.renderShell();
   }
@@ -492,6 +490,12 @@ export class FleetPanel extends Container {
   }
 
   handleInput(data: string): void {
+    // Escape policy (#63): every modal branch below intercepts Escape BEFORE the active Input
+    // sees it, so pi-tui's Input.onEscape never fires in this panel — Escape always cancels
+    // the active flow. Defaults are accepted via Enter-on-blank ("blank=default" prompts).
+    // Caveat: ctrl+c also matches pi-tui's tui.select.cancel but is NOT intercepted here —
+    // it forwards to the Input, which ignores control characters (silent no-op). An onEscape
+    // callback re-added later would fire on ctrl+c but never on Escape — do not re-add.
     if (this.infoAgent) {
       if (matchesKey(data, "escape")) { this.infoAgent = null; this.renderShell(); }
       return;
@@ -811,13 +815,13 @@ export class FleetPanel extends Container {
           this.pendingCheckpoint = null;
           this.renderShell();
         };
-        this.lcReviseInput.onEscape = () => { this.lcRevising = false; this.lcReviseInput = null; this.renderShell(); };
         this.renderShell();
         return;
       }
     }
     if (this.lcRevising && this.lcReviseInput) {
-      if (matchesKey(data, "escape")) { this.lcRevising = false; this.lcReviseInput = null; this.renderShell(); return; }
+      // Escape never reaches here — the panel-level intercept above resolves the pending
+      // checkpoint as abort + closes the panel first (#63). Only printable input forwards.
       this.lcReviseInput.handleInput(data);
       this.invalidate();
       return;
@@ -842,13 +846,10 @@ export class FleetPanel extends Container {
           const lcName = name.trim() || "default";
           this.executeScheduleAdd(task.trim(), expr.trim(), lcName);
         };
-        this.schedNameInput.onEscape = () => { this.executeScheduleAdd(task.trim(), expr.trim(), "default"); };
         this.renderShell();
       };
-      this.schedExprInput.onEscape = () => this.cancelScheduleAdd();
       this.renderShell();
     };
-    this.schedTaskInput.onEscape = () => this.cancelScheduleAdd();
     this.schedRunMode = true;
     this.renderShell();
   }
@@ -892,7 +893,6 @@ export class FleetPanel extends Container {
       if (!followUp.trim()) { this.cancelResume(); return; }
       void this.executeResume(run, followUp.trim());
     };
-    this.resumeInput.onEscape = () => this.cancelResume();
     this.resumeMode = true;
     this.renderShell();
   }
@@ -916,7 +916,6 @@ export class FleetPanel extends Container {
       if (!text.trim()) { this.cancelSteer(); return; }
       void this.executeSteer(run.runId, text.trim());
     };
-    this.steerInput.onEscape = () => this.cancelSteer();
     this.steerMode = true;
     this.renderShell();
   }
@@ -969,7 +968,6 @@ export class FleetPanel extends Container {
     }
     this.tiersInput = new Input();
     this.tiersInput.onSubmit = (value: string) => { void this.executeTiersEdit(value, phase); };
-    this.tiersInput.onEscape = () => this.cancelTiersEdit();
     this.tiersEditPhase = phase;
     this.renderShell();
   }
@@ -995,7 +993,6 @@ export class FleetPanel extends Container {
       }
       this.cancelWorkflowRun();
     };
-    this.wfPromptInput.onEscape = () => this.cancelWorkflowRun();
     this.wfRunMode = true;
     this.renderShell();
   }
@@ -1097,10 +1094,8 @@ export class FleetPanel extends Container {
       this.linkInput.onSubmit = (todoIdRaw: string) => {
         void this.executeFork(run.agent, finalTask, todoIdRaw.trim() || undefined, run.runId);
       };
-      this.linkInput.onEscape = () => { void this.executeFork(run.agent, finalTask, undefined, run.runId); };
       this.renderShell();
     };
-    this.taskInput.onEscape = () => this.cancelRun();
     this.runMode = true;
     this.renderShell();
   }
@@ -1134,19 +1129,16 @@ export class FleetPanel extends Container {
         const lcName = name.trim() || "default";
         this.lcPhase = "cwd";
         this.lcCwdInput = new Input();
-        // SPEC-6-5: 3rd input step — the dispatch cwd. Prefilled with the session cwd; Enter
-        //  accepts it, Escape accepts the default (mirrors the name step's Escape-accepts-default).
+        // SPEC-6-5: 3rd input step — the dispatch cwd. Enter accepts the session cwd (blank)
+        // or a typed path; Escape cancels the run (panel-level intercept — #63).
         this.lcCwdInput.onSubmit = (cwd: string) => {
           const picked = cwd.trim() || this.deps.parentCwd;
           void this.executeLifecycleRun(task.trim(), lcName, picked);
         };
-        this.lcCwdInput.onEscape = () => { void this.executeLifecycleRun(task.trim(), lcName, this.deps.parentCwd); };
         this.renderShell();
       };
-      this.lcNameInput.onEscape = () => { void this.executeLifecycleRun(task.trim(), "default", this.deps.parentCwd); };
       this.renderShell();
     };
-    this.lcTaskInput.onEscape = () => this.cancelLifecycleRun();
     this.lcRunMode = true;
     this.renderShell();
   }

package/src/runtime/run-log.ts

@@ -33,6 +33,12 @@ export interface RunEndedEvent {
   costTotal?: number;
   /** SPEC-6-1: latest context-token snapshot at run end. */
   contextTokens?: number;
+  /** #59: the failure reason on failed runs (post-hoc diagnosability from the journal). */
+  error?: string;
+  /** #61: executed-tool count (the zero-work premature-return signal, post-hoc too). */
+  toolCallCount?: number;
+  /** #60: file paths the run mutated (post-hoc — was previously SpawnResult-only). */
+  filesTouched?: string[];
 }
 export type RunLogEvent = RunMetaEvent | MessageEvent | ToolEvent | RunEndedEvent;
 

package/src/tiers/builtin.ts

@@ -1,8 +1,17 @@
 import type { Tier } from "./tier-registry.ts";
 
-/** Shipped default tiers (Q10). Overridable via global/project tiers.json. */
+/**
+ * Shipped default tiers (Q10). Overridable via global/project tiers.json.
+ *
+ * Provider-agnostic since #64: the `inherit` sentinel resolves to the parent/active
+ * session model, so zero-config fleets work on ANY provider. Users who want real
+ * multi-model cost routing override these by name with concrete `provider/id`
+ * chains (`inherit` may also appear mid-chain as a fallback). `contextFloor`
+ * guards concrete candidates; `costCap` is a per-run $ abort (configure where
+ * meaningful — it is a no-op on flat subscriptions).
+ */
 export const BUILTIN_TIERS: Tier[] = [
-  { name: "economy",  models: ["Ollama/minimax-m3:cloud"] },
-  { name: "standard", models: ["Ollama/glm-5.2:cloud", "Ollama/minimax-m3:cloud"] },
-  { name: "frontier", models: ["anthropic/claude-sonnet-4", "Ollama/glm-5.2:cloud"], costCap: 5, contextFloor: 200000 },
-];
+  { name: "economy",  models: ["inherit"] },
+  { name: "standard", models: ["inherit"] },
+  { name: "frontier", models: ["inherit"], contextFloor: 200000 },
+];

package/src/tiers/resolve.ts

@@ -34,6 +34,20 @@ export function resolveAgentModel(
     if (!tier) return { error: `tier '${agent.tier}' not found; available: ${tiers.list().map((t) => t.name).join(", ")}` };
     const candidates: string[] = [];
     for (const m of tier.models) {
+      if (m.trim().toLowerCase() === "inherit") {
+        // #64: "inherit" = use the parent/active model — always eligible, no catalog or
+        // contextFloor check (the session model is presumed appropriate; the floor guards
+        // concrete candidates). Participates in the chain: eligible concrete models listed
+        // before it win; after them it acts as the provider-agnostic fallback.
+        // Sentinel is case-insensitive/trimmed; concrete model strings stay verbatim.
+        // Empty parentModel (dispatch before a session model exists) is NOT pushed — a
+        // pure-inherit tier then falls to the descriptive no-eligible-model error below.
+        if (parentModel.provider || parentModel.id) {
+          const parent = `${parentModel.provider}/${parentModel.id}`;
+          if (!candidates.includes(parent)) candidates.push(parent);
+        }
+        continue;
+      }
       const { provider, id } = splitModel(m, parentModel.provider);
       const model = modelRegistry.find(provider, id);
       if (!model) continue;                                              // not in catalog → skip

package/src/tools/subagent.ts

@@ -231,14 +231,43 @@ export function createSubagentTool(deps: SubagentToolDeps) {
         });
         retriedWithModel = fallback;
       }
+      // #59: when the fallback retry ALSO fails, surface the PRIMARY's failure too — returning
+      // only the fallback's error masked why the primary (e.g. an explicit model string) failed
+      // at all, making provider diagnosis impossible from the controller's seat.
+      if (retriedWithModel && finalRes.status === "failed" && res.error && res.error !== finalRes.error) {
+        finalRes = {
+          ...finalRes,
+          error: `primary '${res.model}' failed: ${res.error}; fallback '${retriedWithModel}' failed: ${finalRes.error ?? finalRes.status}`,
+        };
+      }
+      // #58: a retryable failure with NO fallback configured (neither per-dispatch nor global)
+      // means the auto-retry silently didn't fire — surface that, and how to enable it, exactly
+      // when it matters. Mutually exclusive with the #59 composition above (a retry implies a
+      // fallback was configured).
+      if (finalRes.status === "failed" && finalRes.retryable && !fallback) {
+        finalRes = {
+          ...finalRes,
+          error: `${finalRes.error ?? finalRes.status}\n(no modelFallback configured — pass modelFallback or set ARMORY_FLEET_MODEL_FALLBACK to enable one-shot auto-retry)`,
+        };
+      }
       const isError = finalRes.status === "failed" || finalRes.status === "aborted";
+      // #61: a run that "completed" without a single tool call is usually a premature return
+      // (the child narrated a plan and ended without acting) — flag it in-band so the controller
+      // verifies (git status/log) instead of trusting a terse planning statement as a completion.
+      const zeroToolRun = !isError && (finalRes.toolCallCount ?? 0) === 0;
+      const resultText = isError
+        ? (finalRes.error ?? finalRes.status)
+        : zeroToolRun
+          ? `[FLEET] zero-tool-call run — likely a premature return (#61); verify with git status/log before trusting this result.\n\n${finalRes.finalText}`
+          : finalRes.finalText;
       return {
-        content: [{ type: "text" as const, text: isError ? (finalRes.error ?? finalRes.status) : finalRes.finalText }],
+        content: [{ type: "text" as const, text: resultText }],
         details: {
           runId: finalRes.runId, todoId: finalRes.todoId, agent: finalRes.agent, model: finalRes.model,
           status: finalRes.status, durationMs: finalRes.durationMs, tokenTotal: finalRes.tokenTotal,
           retriedWithModel,
           filesTouched: finalRes.filesTouched, reachedSummary: finalRes.reachedSummary,
+          toolCallCount: finalRes.toolCallCount,   // #61: zero = the premature-return signal
         },
         isError,
       };