@harness-engineering/orchestrator 0.15.0 → 0.16.0

package/dist/index.mjs

@@ -2011,7 +2011,11 @@ var RoutingConfigSchema = z.object({
   // --- AMR: opt-in adaptive-routing policy. Its PRESENCE flips the orchestrator
   // from identity/default dispatch to complexity-aware tier routing (default-off
   // when absent). Previously accepted by the runtime PUT endpoint only. ---
-  policy: RoutingPolicySchema.optional()
+  policy: RoutingPolicySchema.optional(),
+  // local-backend-full-workflow Phase 3 (D5/SC6): routes the LOCAL outcome-eval
+  // gate to the primary backend when 'primary'. .strict() below means this MUST
+  // be declared here or a config with workflowGates is silently rejected.
+  workflowGates: z.enum(["local", "primary"]).optional()
 }).strict();
 var CONFIDENCE = z.enum(["low", "medium", "high"]);
 var V1_MAX_RATCHET_STAGE = 2;
@@ -2300,9 +2304,19 @@ var WorkflowLoader = class {
       if (!configResult.ok) {
         return Err2(configResult.error);
       }
+      const localTemplatePath = path7.join(path7.dirname(filePath), "harness.orchestrator.local.md");
+      let localPromptTemplate;
+      try {
+        const localContent = await fs7.readFile(localTemplatePath, "utf-8");
+        const localParts = localContent.split("---");
+        localPromptTemplate = localParts.length >= 3 ? localParts.slice(2).join("---").trim() : localContent.trim();
+      } catch {
+        localPromptTemplate = void 0;
+      }
       return Ok3({
         config: configResult.value.config,
         promptTemplate,
+        ...localPromptTemplate !== void 0 ? { localPromptTemplate } : {},
         warnings: configResult.value.warnings
       });
     } catch (error) {
@@ -4346,7 +4360,7 @@ var LocalModelResolver = class {
     if (useCase === void 0) return this.resolved;
     const profile = useCaseToProfile(useCase);
     if (profile === "general") return this.resolved;
-    return this.selectMatch(this.candidates(profile), this.detected);
+    return this.selectMatch(this.candidates(profile, { requireToolCalling: true }), this.detected);
   }
   getStatus() {
     return {
@@ -4364,8 +4378,8 @@ var LocalModelResolver = class {
    * from pool entries (currentScore desc → ollamaName); otherwise the static
    * `configured` list is returned unchanged (byte-identical to pre-Phase-4).
    */
-  candidates(profile) {
-    return this.poolState ? poolStateToCandidates(this.poolState.snapshot(), profile) : [...this.configured];
+  candidates(profile, opts) {
+    return this.poolState ? poolStateToCandidates(this.poolState.snapshot(), profile, opts) : [...this.configured];
   }
   onStatusChange(handler) {
     this.listeners.add(handler);
@@ -4552,7 +4566,8 @@ import {
   createNativeRecommender,
   loadFrozenCandidates,
   selectCandidates as selectCandidates2,
-  curationFromCandidates
+  curationFromCandidates,
+  probeToolCalling
 } from "@harness-engineering/local-models";
 import { createModelProposal as createModelProposal2, listProposals as listProposals2, updateProposal as updateProposal5 } from "@harness-engineering/core";
 
@@ -6036,13 +6051,14 @@ function mapPiEvent(rawEvent, sessionId) {
   }
   return null;
 }
+var LOCAL_PROVIDER = "harness-local";
 function buildLocalModel(config) {
   if (!config.model) return void 0;
   return {
     id: config.model,
     name: config.model,
     api: "openai-completions",
-    provider: "harness-local",
+    provider: LOCAL_PROVIDER,
     baseUrl: config.endpoint ?? "http://localhost:1234/v1",
     reasoning: false,
     input: ["text"],
@@ -6090,9 +6106,12 @@ var PiBackend = class {
         endpoint: this.config.endpoint,
         apiKey: this.config.apiKey
       });
+      const authStorage = piSdk.AuthStorage.inMemory();
+      authStorage.setRuntimeApiKey(LOCAL_PROVIDER, this.config.apiKey ?? "ollama");
       const { session: piSession } = await piSdk.createAgentSession({
         cwd: params.workspacePath,
         ...model !== void 0 && { model },
+        authStorage,
         sessionManager: piSdk.SessionManager.inMemory()
       });
       const session = {
@@ -13468,7 +13487,7 @@ var StructuredLogger = class {
 
 // src/workspace/config-scanner.ts
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import { join as join15, relative as relative2 } from "path";
+import { join as join16, relative as relative2 } from "path";
 import {
   scanForInjection,
   SecurityScanner,
@@ -13514,7 +13533,7 @@ async function scanWorkspaceConfig(workspacePath) {
   const scanner = new SecurityScanner(parseSecurityConfig({}));
   const results = [];
   for (const configFile of CONFIG_FILES) {
-    const result = await scanSingleFile(join15(workspacePath, configFile), workspacePath, scanner);
+    const result = await scanSingleFile(join16(workspacePath, configFile), workspacePath, scanner);
     if (result) results.push(result);
   }
   return { exitCode: computeScanExitCode(results), results };
@@ -15410,6 +15429,55 @@ function normalizeHarnessCommand(command) {
   if (command[0] === "harness") return command;
   return ["harness", ...command];
 }
+function truncateGateOutput(output, max = 4e3) {
+  const trimmed = output.trim();
+  if (trimmed.length <= max) return trimmed;
+  const head = trimmed.slice(0, Math.floor(max * 0.7));
+  const tail = trimmed.slice(-Math.floor(max * 0.3));
+  return `${head}
+\u2026 [truncated ${trimmed.length - max} chars] \u2026
+${tail}`;
+}
+async function defaultLocalVerifyRunner(workspacePath) {
+  const cp2 = await import("child_process");
+  const fsMod = await import("fs");
+  const pathMod = await import("path");
+  const run = (script) => new Promise((resolve8) => {
+    cp2.execFile(
+      "pnpm",
+      ["-w", "run", script],
+      { cwd: workspacePath, maxBuffer: 32 * 1024 * 1024 },
+      (error, stdout, stderr) => {
+        if (error) {
+          resolve8({
+            ok: false,
+            output: `${script} failed:
+${stdout ?? ""}
+${stderr ?? error.message}`
+          });
+        } else {
+          resolve8({ ok: true, output: "" });
+        }
+      }
+    );
+  });
+  const pkgPath = pathMod.join(workspacePath, "package.json");
+  if (!fsMod.existsSync(pkgPath)) return { ok: true, output: "" };
+  const scripts = (() => {
+    try {
+      const pkg = JSON.parse(fsMod.readFileSync(pkgPath, "utf8"));
+      return pkg.scripts ?? {};
+    } catch {
+      return {};
+    }
+  })();
+  for (const script of ["typecheck", "lint", "test"]) {
+    if (scripts[script] === void 0) continue;
+    const result = await run(script);
+    if (!result.ok) return result;
+  }
+  return { ok: true, output: "" };
+}
 var Orchestrator = class extends EventEmitter {
   state;
   config;
@@ -15459,6 +15527,30 @@ var Orchestrator = class extends EventEmitter {
   overrideBackend;
   renderer;
   promptTemplate;
+  /**
+   * Backend-aware local dispatch template (Phase 1). Set from
+   * `overrides.localPromptTemplate` (production: threaded by the CLI from
+   * WorkflowLoader). Undefined -> resolvePromptTemplate falls back to the
+   * default template (SC5).
+   */
+  localPromptTemplate;
+  /**
+   * local-backend-full-workflow Phase 2 (Option C): the verify runner the
+   * local-only enforced gate (`runLocalWorkflowGate`) invokes to run the
+   * project's mechanical gate (typecheck + lint + test) over the workspace.
+   * Injected in tests to force fail→pass sequences; in production it defaults
+   * to `defaultLocalVerifyRunner` (a thin project-script probe). Kept as a
+   * field seam — mirrors how `execFileFn` is injected — so the completion path
+   * is decoupled from the concrete detector.
+   */
+  verifyRunner;
+  /**
+   * Phase 2: the most recent gate-failure reason per issue, threaded into the
+   * next dispatch's rendered prompt as a failure preamble (the re-prompt). Set
+   * when a local gate blocks; consumed + cleared at the next `dispatchIssue`
+   * render for that issue.
+   */
+  priorGateFailureByIssue = /* @__PURE__ */ new Map();
   server;
   interval;
   heartbeatInterval;
@@ -15628,6 +15720,8 @@ var Orchestrator = class extends EventEmitter {
     this.setMaxListeners(50);
     this.config = config;
     this.promptTemplate = promptTemplate;
+    this.localPromptTemplate = overrides?.localPromptTemplate;
+    this.verifyRunner = overrides?.verifyRunner ?? defaultLocalVerifyRunner;
     this.state = createEmptyState(config);
     this.logger = new StructuredLogger();
     try {
@@ -16346,6 +16440,7 @@ ${messages}`);
         break;
       case "escalate":
         await this.handleEscalation(effect);
+        this.priorGateFailureByIssue.delete(effect.issueId);
         await this.persistLaneSafe(effect.issueId, "abandon");
         break;
       case "claim":
@@ -16625,6 +16720,31 @@ ${messages}`);
       });
     }
   }
+  /**
+   * Phase 1 (local-backend-full-workflow): pick the dispatch template for
+   * the resolved backend. `pi`/`local` backends get the bash-shaped local
+   * template when one was loaded; every other backend — and any local
+   * backend with no local template loaded (SC5) — gets the default. Pure
+   * over (backendName, config.agent.backends, localPromptTemplate,
+   * promptTemplate); unit-tested by orchestrator.template-resolution.test.ts.
+   *
+   * NOTE: the local template file (`harness.orchestrator.local.md`) carries a
+   * full YAML frontmatter block, but that frontmatter is **intentionally
+   * ignored** at dispatch — only the markdown body is loaded (WorkflowLoader
+   * strips the frontmatter) and rendered here as the prompt. The frontmatter
+   * exists solely so the file is a valid, self-documenting scaffold that
+   * `harness init` can drop in; the orchestrator's configuration is always
+   * read from the loaded `WorkflowConfig`, never from this template file's
+   * frontmatter.
+   */
+  resolvePromptTemplate(backendName) {
+    const def = this.config.agent.backends?.[backendName];
+    const isLocal = def?.type === "local" || def?.type === "pi";
+    if (isLocal && this.localPromptTemplate !== void 0) {
+      return this.localPromptTemplate;
+    }
+    return this.promptTemplate;
+  }
   /**
    * Dispatches a new agent to work on an issue.
    *
@@ -16712,10 +16832,6 @@ ${messages}`);
         void executeWorkflow(ctx, workflowPlan);
         return;
       }
-      const prompt = await this.renderer.render(this.promptTemplate, {
-        issue,
-        attempt: attempt || 1
-      });
       const useCase = buildRoutingUseCase(issue, backend, this.skillCatalog);
       const invocationOverride = process.env.HARNESS_BACKEND_OVERRIDE;
       const routerOpts = invocationOverride ? { invocationOverride } : void 0;
@@ -16753,6 +16869,25 @@ ${messages}`);
         const routingDefaultScalar = routingDefault !== void 0 ? toArray(routingDefault)[0] : void 0;
         routedBackendName = routingDefaultScalar ?? this.config.agent.backend ?? "unknown";
       }
+      const renderedPrompt = await this.renderer.render(
+        this.resolvePromptTemplate(routedBackendName),
+        {
+          issue,
+          attempt: attempt || 1
+        }
+      );
+      const priorGateFailure = this.priorGateFailureByIssue.get(issue.id);
+      const prompt = priorGateFailure !== void 0 ? `${renderedPrompt}
+
+## Previous attempt failed the enforced gate
+
+Your prior attempt was blocked by the harness gate and re-dispatched. Fix the following before shipping:
+
+${priorGateFailure}
+` : renderedPrompt;
+      if (priorGateFailure !== void 0) {
+        this.priorGateFailureByIssue.delete(issue.id);
+      }
       const session = {
         sessionId: `pending-${Date.now()}`,
         backendName: routedBackendName,
@@ -16806,7 +16941,14 @@ ${messages}`);
       const activeRunner = new AgentRunner(agentBackend, {
         maxTurns: this.config.agent.maxTurns
       });
-      this.runAgentInBackgroundTask(issue, workspacePath, prompt, attempt, activeRunner);
+      this.runAgentInBackgroundTask(
+        issue,
+        workspacePath,
+        prompt,
+        attempt,
+        activeRunner,
+        routedBackendName
+      );
     } catch (error) {
       if (await this.handleRoutingFailure(issue, error)) {
         return;
@@ -16840,8 +16982,9 @@ ${messages}`);
       await new Promise((r) => setTimeout(r, waitTime));
     }
   }
-  runAgentInBackgroundTask(issue, workspacePath, prompt, attempt, runner) {
+  runAgentInBackgroundTask(issue, workspacePath, prompt, attempt, runner, routedBackendName) {
     const activeRunner = runner;
+    const gateBackendName = routedBackendName ?? this.state.running.get(issue.id)?.session?.backendName;
     this.logger.info(`Starting background task for ${issue.identifier}`);
     const abortController = new AbortController();
     this.abortControllers.set(issue.id, { controller: abortController, pid: null });
@@ -16878,10 +17021,7 @@ ${messages}`);
             await this.emitWorkerExit(issue.id, "error", attempt, "Stopped by reconciliation");
           }
         } else {
-          const qualityClass = await this.deriveSingleAgentQualityVerdict(issue, workspacePath);
-          const retroClass = await this.deriveRoutingRetrospectiveVerdict(issue, workspacePath);
-          const outcomeClass = qualityClass ?? retroClass;
-          await this.emitWorkerExit(issue.id, "normal", attempt, void 0, outcomeClass);
+          await this.finalizeNormalCompletion(issue, workspacePath, attempt, gateBackendName);
         }
       } catch (error) {
         this.logger.error(`Agent runner failed for ${issue.identifier}`, { error: String(error) });
@@ -16899,6 +17039,93 @@ ${messages}`);
       this.logger.error("Fatal error in background task", { error: String(err) });
     });
   }
+  /**
+   * local-backend-full-workflow Phase 2 (Option C): the normal-exit completion
+   * seam, extracted so the enforced-gate loop is directly testable. Runs the
+   * LOCAL-ONLY enforced gate BEFORE the exit is treated as terminal; a red gate
+   * routes through the SHIPPED `emitWorkerExit('error', …)` retry branch — the
+   * re-dispatch IS the re-prompt (the next render threads the failure preamble),
+   * and `checkRetryBudget` exhaustion queues `needs-human`. On a green gate (or a
+   * non-local backend, where the gate is a no-op `{ ok: true }`), the existing
+   * Claude/AMR verdict feeders run and the run completes normally — composition,
+   * not replacement.
+   */
+  async finalizeNormalCompletion(issue, workspacePath, attempt, gateBackendName) {
+    const gate = gateBackendName !== void 0 ? (
+      // B3: the VERIFY sub-gate is fail-CLOSED (a gate that can't run blocks +
+      // re-dispatches). The outcome-eval sub-gate is fail-OPEN by design — an
+      // unreachable eval provider (incl. a workflowGates:'primary' backend that's
+      // down) degrades to a neutral verdict rather than wedging EVERY local
+      // dispatch; the verify gate remains the hard safety floor.
+      await this.runLocalWorkflowGate(issue, workspacePath, gateBackendName)
+    ) : { ok: true };
+    if (!gate.ok) {
+      this.priorGateFailureByIssue.set(issue.id, gate.reason);
+      this.logger.info(`local workflow gate blocked ${issue.identifier}; re-dispatching (SC3)`, {
+        issueId: issue.id
+      });
+      await this.emitWorkerExit(issue.id, "error", attempt, gate.reason);
+      return;
+    }
+    const qualityClass = await this.deriveSingleAgentQualityVerdict(issue, workspacePath);
+    const retroClass = await this.deriveRoutingRetrospectiveVerdict(issue, workspacePath);
+    const outcomeClass = qualityClass ?? retroClass;
+    await this.emitWorkerExit(issue.id, "normal", attempt, void 0, outcomeClass);
+  }
+  /**
+   * local-backend-full-workflow Phase 2 (Option C): the LOCAL-ONLY enforced
+   * gate. For a `pi`/`local` dispatch it runs the mechanical gate (verify =
+   * typecheck+lint+test via the injected `verifyRunner`) and, on green, the
+   * outcome-eval (Task 7) against the workspace branch; a red result returns a
+   * blocking `{ ok: false, reason }`. The completion path routes that reason
+   * through `emitWorkerExit('error', …)` so the shipped state-machine retry
+   * branch re-dispatches (the re-prompt) rather than marking the run complete.
+   *
+   * NON-local backends (Claude/AMR) get an unconditional `{ ok: true }` — this
+   * gate never touches their completion path (D2 scopes enforcement to the
+   * local path only; the AMR verdict feeders keep their existing behavior).
+   *
+   * Fully guarded: any thrown error → a CONSERVATIVE block `{ ok: false,
+   * reason: 'gate error: …' }`, mirroring the shipped fail-safe pattern — a
+   * gate that cannot run is treated as red (re-dispatch), never as a silent
+   * pass that could ship a bad build.
+   */
+  async runLocalWorkflowGate(issue, workspacePath, backendName) {
+    const def = this.config.agent.backends?.[backendName];
+    const isLocal = def?.type === "local" || def?.type === "pi";
+    if (!isLocal) return { ok: true };
+    try {
+      const verify = await this.verifyRunner(workspacePath);
+      if (!verify.ok) {
+        return {
+          ok: false,
+          reason: `verify failed:
+${truncateGateOutput(verify.output)}`
+        };
+      }
+      if (issue.spec !== null) {
+        const model = this.config.agent.routing?.policy?.acceptanceEval?.model;
+        const evalClass = await this.evaluateOutcomeCore(issue, workspacePath, model, "local");
+        if (evalClass === "quality-fail") {
+          return {
+            ok: false,
+            reason: "outcome-eval returned a high-confidence NOT_SATISFIED verdict: the implementation does not satisfy the spec."
+          };
+        }
+      }
+      return { ok: true };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn(
+        `local workflow gate errored for ${issue.identifier}; blocking conservatively`,
+        {
+          issueId: issue.id,
+          error: msg
+        }
+      );
+      return { ok: false, reason: `gate error: ${msg}` };
+    }
+  }
   /**
    * AMR 4c (ADR 0069): the sound single-agent quality-verdict feeder. On a normal
    * exit, when AMR is active, run a BASELINE-RELATIVE security scan of the lines
@@ -16950,13 +17177,82 @@ ${messages}`);
   async deriveAcceptanceEvalVerdict(issue, workspacePath) {
     const acceptanceEval = this.config.agent.routing?.policy?.acceptanceEval;
     if (acceptanceEval?.enabled !== true || issue.spec === null) return void 0;
-    const provider = this.resolveComplexityProvider();
+    return this.evaluateOutcomeCore(issue, workspacePath, acceptanceEval.model, "amr");
+  }
+  /**
+   * local-backend-full-workflow Phase 2 (Option C, SC4): the SHARED outcome-eval
+   * core, lifted out of `deriveAcceptanceEvalVerdict` so BOTH callers reuse the
+   * same `OutcomeEvaluator` engine over the introduced diff vs the spec's
+   * judgment section. It does NOT gate on `adaptiveRouter !== null` or
+   * `acceptanceEval.enabled` — those guards live in the AMR caller above; the
+   * LOCAL gate (D2) always evaluates when a spec is present. Maps a
+   * high-confidence NOT_SATISFIED to `'quality-fail'`; conservative + fully
+   * guarded: no spec / no provider / empty diff / any error → `undefined`.
+   */
+  /**
+   * local-backend-full-workflow Phase 3 (D5/SC6): resolve the AnalysisProvider
+   * for the outcome-eval gate. Caller-gated: ONLY the LOCAL gate caller consults
+   * `agent.routing.workflowGates`. The AMR caller ALWAYS uses local SEL
+   * (`resolveComplexityProvider`) so the AMR acceptance-eval path is byte-identical
+   * (SC-neutral). When `workflowGates === 'primary'` on the local caller, resolve
+   * from the primary (routing.default) backend; any miss degrades to local SEL
+   * (fail-open — an unreachable stronger provider must NOT wedge the local gate;
+   * see the fail-open note at the runLocalWorkflowGate call site).
+   */
+  resolveOutcomeEvalProvider(caller) {
+    if (caller === "local" && this.config.agent.routing?.workflowGates === "primary") {
+      return this.resolvePrimaryOutcomeEvalProvider() ?? this.resolveComplexityProvider();
+    }
+    return this.resolveComplexityProvider();
+  }
+  /**
+   * Build an AnalysisProvider from the PRIMARY (routing.default) backend for the
+   * Phase-3 `workflowGates:'primary'` seam. Reuses the shipped
+   * `buildAnalysisProvider` translator but forces the router to the default
+   * backend. Returns undefined (→ caller degrades to local SEL) when intelligence
+   * is disabled, the factory is absent, or the default backend cannot produce a
+   * provider — fully guarded, never throws.
+   */
+  resolvePrimaryOutcomeEvalProvider() {
+    try {
+      if (!this.config.intelligence?.enabled || !this.backendFactory) return void 0;
+      const backends = this.config.agent.backends;
+      const def0 = this.config.agent.routing?.default;
+      const defaultName = Array.isArray(def0) ? def0[0] : def0;
+      if (defaultName === void 0) return void 0;
+      const def = backends?.[defaultName];
+      if (!def) return void 0;
+      return buildAnalysisProvider({
+        def,
+        backendName: defaultName,
+        layer: "sel",
+        getResolverStatusSnapshot: () => {
+          const resolver = this.localResolvers.get(defaultName);
+          if (!resolver) return null;
+          const s = resolver.getStatus();
+          return {
+            available: s.available,
+            resolved: s.resolved,
+            configured: s.configured,
+            detected: s.detected
+          };
+        },
+        intelligence: this.config.intelligence,
+        logger: this.logger
+      }) ?? void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  async evaluateOutcomeCore(issue, workspacePath, model, caller) {
+    if (issue.spec === null) return void 0;
+    const provider = this.resolveOutcomeEvalProvider(caller);
     if (provider === void 0) return void 0;
     try {
       const diff = await this.workspace.getIntroducedDiffText(issue.identifier);
       if (diff.trim() === "") return void 0;
       const evaluator = new OutcomeEvaluator(provider, this.graphStore ?? new GraphStore2(), {
-        ...acceptanceEval.model !== void 0 ? { model: acceptanceEval.model } : {}
+        ...model !== void 0 ? { model } : {}
       });
       const verdict = await evaluator.evaluate({
         specPath: path21.join(workspacePath, issue.spec),
@@ -16968,14 +17264,17 @@ ${messages}`);
       });
       const cls = outcomeVerdictToQualityFail(verdict);
       if (cls === "quality-fail") {
-        this.logger.info("amr:quality-fail \u2014 acceptance-eval NOT_SATISFIED (high confidence)", {
-          issueId: issue.id,
-          rationale: verdict.rationale
-        });
+        this.logger.info(
+          `${caller}:quality-fail \u2014 acceptance-eval NOT_SATISFIED (high confidence)`,
+          {
+            issueId: issue.id,
+            rationale: verdict.rationale
+          }
+        );
       }
       return cls;
     } catch (err) {
-      this.logger.debug("amr acceptance-eval skipped (best-effort)", {
+      this.logger.debug(`${caller} acceptance-eval skipped (best-effort)`, {
         issueId: issue.id,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -17542,6 +17841,15 @@ ${messages}`);
     }
     this.seedRecommender(candidates, "frozen");
     const recommend = (hardware) => this.modelRecommender(hardware);
+    let localEndpoint;
+    let localApiKey;
+    for (const def of Object.values(this.config.agent.backends ?? {})) {
+      if ((def.type === "local" || def.type === "pi") && typeof def.endpoint === "string") {
+        localEndpoint = def.endpoint;
+        localApiKey = def.apiKey;
+        break;
+      }
+    }
     this.refreshScheduler = new RefreshScheduler({
       runTick: () => runRefreshTick({
         detectHardware: () => this.detectLmlmHardware(),
@@ -17559,7 +17867,14 @@ ${messages}`);
             target: c.target.ollamaName
           });
         }),
-        proposalThreshold: refreshCfg?.proposalThreshold ?? 5
+        proposalThreshold: refreshCfg?.proposalThreshold ?? 5,
+        ...localEndpoint !== void 0 ? {
+          probeToolCalling: (ollamaName) => probeToolCalling({
+            model: ollamaName,
+            baseUrl: localEndpoint,
+            ...localApiKey !== void 0 ? { apiKey: localApiKey } : {}
+          })
+        } : {}
       }).then((result) => {
         void this.drainDeferredEvictions();
         return result;
@@ -18271,7 +18586,8 @@ async function triageIssue2(issue, deps = {}) {
     ...graph ? { graph } : {},
     ...deps.precedent ? { precedent: deps.precedent } : {},
     ...deps.config ? { config: deps.config } : {},
-    ...deps.models ? { models: deps.models } : {}
+    ...deps.models ? { models: deps.models } : {},
+    ...deps.modelDeferred ? { modelDeferred: true } : {}
   });
 }
 
@@ -18301,7 +18617,7 @@ var ForkStepSchema = z18.object({
 var BRAINSTORM_RUBRIC = 'You are running an AUTONOMOUS brainstorm over one backlog item: enumerate each design fork (a decision with mutually-exclusive options), then recommend a default for the NEXT unresolved fork with a self-assessed confidence. Report confidence HIGH only when the recommendation is clearly correct on technical grounds alone. Report LOW (so a human decides) whenever the fork involves ANY of: a product or UX tradeoff, an unrevealed business priority, a security-sensitive or irreversible/outward-facing action, or a genuine judgment call between comparable options. Never invent forks to pad the spec; set done=true once every real fork is resolved. Be conservative \u2014 a false "high" is far more costly than asking a human.';
 function makeSelForkGenerator(provider, input, opts = {}) {
   const samples = Math.max(2, opts.samples ?? 3);
-  const maxTokens = opts.maxTokens ?? 512;
+  const maxTokens = opts.maxTokens ?? 4096;
   return {
     async next(index, priorDecisions) {
       const prompt = buildForkPrompt(input, priorDecisions, index);
@@ -19200,6 +19516,11 @@ function buildArchiveHooks(opts) {
 
 // src/index.ts
 import { discoverCandidates } from "@harness-engineering/local-models";
+import {
+  PoolStateStore as PoolStateStore2,
+  poolStateToCandidates as poolStateToCandidates3,
+  DEFAULT_POOL_STATE_PATH
+} from "@harness-engineering/local-models";
 export {
   AdaptiveRouter,
   AnalysisArchive,
@@ -19209,6 +19530,7 @@ export {
   BackendRouter,
   CheckScriptRunner,
   ClaimManager,
+  DEFAULT_POOL_STATE_PATH,
   EscalationState,
   GateNotReadyError,
   GateRunError,
@@ -19225,6 +19547,7 @@ export {
   Orchestrator,
   OrchestratorBackendFactory,
   PRDetector,
+  PoolStateStore2 as PoolStateStore,
   PrivacyNoMatch,
   PromotionError,
   PromptRenderer,
@@ -19260,6 +19583,7 @@ export {
   createEmptyState,
   crossFieldRoutingIssues,
   defaultFetchModels,
+  defaultLocalVerifyRunner,
   defaultPoolCapabilities,
   deriveSeedPaths,
   detectScopeTier,
@@ -19293,6 +19617,7 @@ export {
   normalizeLocalModel,
   openSearchIndex,
   pilotScore,
+  poolStateToCandidates3 as poolStateToCandidates,
   precedentLookupFromStored,
   promote,
   rankTriageCandidates,
@@ -19321,6 +19646,7 @@ export {
   syncMain,
   triageIssue2 as triageIssue,
   truncateForBudget,
+  truncateGateOutput,
   validateCustomTasks,
   validateWorkflowConfig,
   wireNotificationSinks,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/orchestrator",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Orchestrator daemon for dispatching coding agents to issues",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -48,11 +48,11 @@
     "ws": "^8.21.0",
     "yaml": "^2.8.3",
     "zod": "^3.25.76",
-    "@harness-engineering/core": "0.37.0",
-    "@harness-engineering/graph": "0.11.8",
-    "@harness-engineering/intelligence": "0.7.0",
-    "@harness-engineering/local-models": "0.5.2",
-    "@harness-engineering/types": "0.22.0"
+    "@harness-engineering/core": "0.37.1",
+    "@harness-engineering/graph": "0.11.9",
+    "@harness-engineering/intelligence": "0.9.0",
+    "@harness-engineering/local-models": "0.6.0",
+    "@harness-engineering/types": "0.23.0"
   },
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^7.3.0",