@iowarp/clio-coder 0.3.1 → 0.3.3

package/src/cli/configure.ts

@@ -26,6 +26,7 @@ import { probeCapabilitiesForModel } from "../domains/providers/model-capabiliti
 import { fingerprintNativeRuntime } from "../domains/providers/probe/fingerprint.js";
 import { getRuntimeRegistry } from "../domains/providers/registry.js";
 import { registerBuiltinRuntimes } from "../domains/providers/runtimes/builtins.js";
+import { greetLmStudio } from "../domains/providers/runtimes/common/lmstudio-http.js";
 import type { ProbeContext, ProbeResult, RuntimeDescriptor } from "../domains/providers/types/runtime-descriptor.js";
 import type { TargetDescriptor } from "../domains/providers/types/target-descriptor.js";
 import { registerClioOAuthProviders } from "../engine/oauth.js";
@@ -88,6 +89,7 @@ const DEFAULT_PORTS: Record<string, number> = {
 	"llamacpp-embed": 8080,
 	"llamacpp-rerank": 8080,
 	"lmstudio-native": 1234,
+	lmstudio: 1234,
 	"ollama-native": 11434,
 	vllm: 8000,
 	sglang: 30000,
@@ -270,7 +272,8 @@ function normalizeUrl(input: string, runtimeId: string): string {
 	const trimmed = input.trim();
 	if (trimmed.length === 0) return defaultUrlFor(runtimeId);
 	const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
-	const withScheme = hasScheme ? trimmed : `http://${trimmed}`;
+	let withScheme = hasScheme ? trimmed : `http://${trimmed}`;
+	if (runtimeId === "lmstudio") withScheme = withScheme.replace(/^ws:/u, "http:").replace(/^wss:/u, "https:");
 	try {
 		const parsed = new URL(withScheme);
 		if (!hasScheme && !parsed.port && DEFAULT_PORTS[runtimeId]) {
@@ -418,10 +421,15 @@ async function runtimeProbe(runtime: RuntimeDescriptor, target: TargetDescriptor
 	}
 }
 
-async function runtimeProbeModels(runtime: RuntimeDescriptor, target: TargetDescriptor): Promise<string[]> {
+async function runtimeProbeModels(
+	runtime: RuntimeDescriptor,
+	target: TargetDescriptor,
+	authToken?: string,
+): Promise<string[]> {
 	if (typeof runtime.probeModels !== "function") return [];
 	try {
-		return await runtime.probeModels(target, await buildProbeContext(runtime, target));
+		const context = await buildProbeContext(runtime, target);
+		return await runtime.probeModels(target, authToken === undefined ? context : { ...context, authToken });
 	} catch {
 		return [];
 	}
@@ -591,6 +599,7 @@ function buildDescriptor(
 		contextWindow?: number;
 		maxTokens?: number;
 		reasoning?: boolean;
+		lmstudio?: TargetDescriptor["lmstudio"];
 	},
 ): TargetDescriptor {
 	const descriptor: TargetDescriptor = { id, runtime: runtime.id };
@@ -615,6 +624,7 @@ function buildDescriptor(
 	if (parts.maxTokens !== undefined) caps.maxTokens = parts.maxTokens;
 	if (parts.reasoning !== undefined) caps.reasoning = parts.reasoning;
 	if (Object.keys(caps).length > 0) descriptor.capabilities = caps;
+	if (parts.lmstudio) descriptor.lmstudio = parts.lmstudio;
 	return descriptor;
 }
 
@@ -673,10 +683,11 @@ async function resolveSupportedWireModels(
 	runtime: RuntimeDescriptor,
 	target: TargetDescriptor,
 	existing?: TargetDescriptor,
+	authToken?: string,
 ): Promise<string[]> {
 	const known = listKnownModelsForRuntime(runtime.id);
 	if (known.length > 0) return known;
-	const discovered = runtime.kind === "http" ? await runtimeProbeModels(runtime, target) : [];
+	const discovered = runtime.kind === "http" ? await runtimeProbeModels(runtime, target, authToken) : [];
 	if (discovered.length > 0) return discovered;
 	return existing?.wireModels ? [...existing.wireModels] : [];
 }
@@ -712,7 +723,7 @@ async function askModelChoice(
  */
 function refuseCatalogSeededModel(runtime: RuntimeDescriptor, support: ProviderSupportEntry): void {
 	printError(
-		`--model is required for ${runtime.id}: its ${support.modelHints.length} model ids come from the pi-ai catalog in name order, which recommends none of them`,
+		`--model is required for ${runtime.id}: its ${support.modelHints.length} model ids come from the provider catalog in name order, which recommends none of them`,
 	);
 	process.stderr.write(
 		`  run \`clio-coder configure --runtime ${runtime.id}\` with no other flags to choose from the full list\n`,
@@ -742,7 +753,7 @@ async function runNonInteractive(runtime: RuntimeDescriptor, args: ParsedArgs):
 	const auth = openAuthStorage();
 	const support = buildProviderSupportEntry(runtime);
 	const existing = settings.targets.find((e) => e.id === args.id);
-	if (existing && existing.runtime !== runtime.id) {
+	if (existing && (getRuntimeRegistry().get(existing.runtime)?.id ?? existing.runtime) !== runtime.id) {
 		printError(`target ${args.id} already exists with runtime ${existing.runtime}`);
 		return 2;
 	}
@@ -750,6 +761,16 @@ async function runNonInteractive(runtime: RuntimeDescriptor, args: ParsedArgs):
 	if (!url && support.supportsCustomUrl) {
 		url = defaultUrlFor(runtime.id);
 	}
+	if (url && runtime.id === "lmstudio") {
+		const greeting = await greetLmStudio(
+			{ id: args.id, runtime: runtime.id, url },
+			{ credentialsPresent: new Set(), httpTimeoutMs: 750 },
+		);
+		if (!greeting.ok) {
+			printError(`refusing to save LM Studio target '${args.id}': ${url} did not return the LM Studio greeting`);
+			return 2;
+		}
+	}
 	if (url && (runtime.id === "openai-compat" || runtime.id === "anthropic-compat")) {
 		const fingerprint = await fingerprintNativeRuntime(url);
 		if (fingerprint) {
@@ -787,8 +808,9 @@ async function runNonInteractive(runtime: RuntimeDescriptor, args: ParsedArgs):
 		...(args.contextWindow !== undefined ? { contextWindow: args.contextWindow } : {}),
 		...(args.maxTokens !== undefined ? { maxTokens: args.maxTokens } : {}),
 		...(args.reasoning !== undefined ? { reasoning: args.reasoning } : {}),
+		...(existing?.lmstudio ? { lmstudio: existing.lmstudio } : {}),
 	});
-	const wireModels = await resolveSupportedWireModels(runtime, seed, existing);
+	const wireModels = await resolveSupportedWireModels(runtime, seed, existing, args.apiKey);
 	const model =
 		args.model ??
 		existing?.defaultModel ??
@@ -816,6 +838,7 @@ async function runNonInteractive(runtime: RuntimeDescriptor, args: ParsedArgs):
 		...(args.contextWindow !== undefined ? { contextWindow: args.contextWindow } : {}),
 		...(args.maxTokens !== undefined ? { maxTokens: args.maxTokens } : {}),
 		...(args.reasoning !== undefined ? { reasoning: args.reasoning } : {}),
+		...(existing?.lmstudio ? { lmstudio: existing.lmstudio } : {}),
 	});
 	const setOrchestrator = args.setOrchestrator || args.orchestratorModel !== undefined;
 	const setBackground = args.setBackground || args.backgroundModel !== undefined;
@@ -933,7 +956,7 @@ async function pickRuntimeFromEntries(
 	}
 }
 
-const LOCAL_APP_RUNTIME_IDS: ReadonlySet<string> = new Set(["ollama-native", "lmstudio-native"]);
+const LOCAL_APP_RUNTIME_IDS: ReadonlySet<string> = new Set(["ollama-native", "lmstudio"]);
 
 // Generic protocol-compatible runtimes. They are classified local-http (they
 // carry a probe and no cloud catalog entry), but a hosted endpoint such as
@@ -1099,6 +1122,16 @@ async function runInteractive(
 			runtime = steered;
 			support = buildProviderSupportEntry(runtime);
 		}
+		if (runtime.id === "lmstudio") {
+			const greeting = await greetLmStudio(
+				{ id: targetId, runtime: runtime.id, url },
+				{ credentialsPresent: new Set(), httpTimeoutMs: 750 },
+			);
+			if (!greeting.ok) {
+				printError(`refusing to save LM Studio target '${targetId}': ${url} did not return the LM Studio greeting`);
+				return 2;
+			}
+		}
 	}
 
 	let apiKeyEnv: string | undefined;
@@ -1174,6 +1207,7 @@ async function runInteractive(
 		...(defaults.contextWindow !== undefined ? { contextWindow: defaults.contextWindow } : {}),
 		...(defaults.maxTokens !== undefined ? { maxTokens: defaults.maxTokens } : {}),
 		...(defaults.reasoning !== undefined ? { reasoning: defaults.reasoning } : {}),
+		...(existing?.lmstudio ? { lmstudio: existing.lmstudio } : {}),
 	});
 
 	if (runtime.kind === "http") {
@@ -1190,7 +1224,7 @@ async function runInteractive(
 			process.stdout.write(`  ${index + 1}. ${wireModel}${wireModel === model ? "  [default]" : ""}\n`);
 		}
 		if (!model && catalogOrdered) {
-			process.stdout.write(`  listed in pi-ai catalog order, which recommends none of them; pick one.\n`);
+			process.stdout.write(`  listed in provider catalog order, which recommends none of them; pick one.\n`);
 		}
 		for (;;) {
 			const pickedModel = await askModelChoice(rl, "Default target model", wireModels, model);
@@ -1259,6 +1293,7 @@ async function runInteractive(
 		...(contextWindowChoice !== undefined ? { contextWindow: contextWindowChoice } : {}),
 		...(defaults.maxTokens !== undefined ? { maxTokens: defaults.maxTokens } : {}),
 		...(reasoningChoice !== undefined ? { reasoning: reasoningChoice } : {}),
+		...(existing?.lmstudio ? { lmstudio: existing.lmstudio } : {}),
 	});
 	try {
 		assertOrchestratorReplacementEligible(settings, descriptor);
@@ -1441,6 +1476,9 @@ export async function runConfigureCommand(argv: ReadonlyArray<string>): Promise<
 			process.stdout.write("run `clio-coder configure --list` to see registered runtimes\n");
 			return 2;
 		}
+		if (runtimeId === "lmstudio-native" && runtime.id === "lmstudio") {
+			process.stderr.write("warning: runtime 'lmstudio-native' is deprecated; using 'lmstudio'\n");
+		}
 	}
 	const hasTargetSetupFlag =
 		args.id !== undefined ||

package/src/cli/context-clear.ts

@@ -9,10 +9,10 @@ const HELP = `Usage:
 Clear accumulated project context owned by the context engine:
 .clio-coder/codewiki.json, .clio-coder/state.json, .clio-coder/handoffs/, and .clio-coder/proposals/.
 
-Preserves by default: CLIO-CODER.md, .clio-coder/agents/, .clio-coder/skills/, and .clio-coder/wiki/.
+Preserves by default: CLIO-CODER.md, CLIO-CODER.override.md, .clio-coder/agents/, .clio-coder/skills/, and .clio-coder/wiki/.
 
 Options:
-  --all       also remove CLIO-CODER.md after a second confirmation
+  --all       also remove the local CLIO-CODER.md after a second confirmation; overrides stay human-owned
   --yes, -y   answer every confirmation, required when stdin is not a terminal
 `;
 

package/src/cli/context-index.ts

@@ -1,11 +1,6 @@
-import {
-	buildCodewiki,
-	type Codewiki,
-	codewikiPath,
-	structuralCodewikiHash,
-	writeCodewiki,
-} from "../domains/context/codewiki/indexer.js";
-import { computeFingerprint } from "../domains/context/fingerprint.js";
+import { codewikiPath, structuralCodewikiHash } from "../domains/context/codewiki/artifact.js";
+import { coordinateCodewikiWrite } from "../domains/context/codewiki/coordinator.js";
+import type { Codewiki } from "../domains/context/codewiki/schema.js";
 import { readClioState, statePath, writeClioState } from "../domains/context/state.js";
 import { detectProjectProfile } from "../domains/session/workspace/project-type.js";
 
@@ -55,22 +50,25 @@ export async function runContextIndexCommand(args: string[]): Promise<number> {
 	const cwd = process.cwd();
 	const now = new Date().toISOString();
 	const profile = detectProjectProfile(cwd);
-	const codewiki = await buildCodewiki({ cwd, language: profile.projectType });
-	writeCodewiki(cwd, codewiki);
-	const prev = readClioState(cwd);
-	const fingerprint = computeFingerprint(cwd, codewiki);
-	writeClioState(cwd, {
-		version: 1,
-		projectType: profile.projectType,
-		fingerprint,
-		codewikiVersion: codewiki.version,
-		...(prev?.contextSources ? { contextSources: prev.contextSources } : {}),
-		...(prev?.contextSourceHash ? { contextSourceHash: prev.contextSourceHash } : {}),
-		...(prev?.lastBootstrap ? { lastBootstrap: prev.lastBootstrap } : {}),
-		...(prev?.lastInitAt ? { lastInitAt: prev.lastInitAt } : {}),
-		lastSessionAt: prev?.lastSessionAt ?? now,
-		lastIndexedAt: now,
+	const coordinated = await coordinateCodewikiWrite(cwd, () => ({ kind: "build", cwd, language: profile.projectType }), {
+		afterCommit: ({ codewiki, fingerprint }, workspace) => {
+			const prev = readClioState(workspace);
+			writeClioState(workspace, {
+				version: 1,
+				projectType: profile.projectType,
+				fingerprint,
+				codewikiVersion: codewiki.version,
+				...(prev?.contextSources ? { contextSources: prev.contextSources } : {}),
+				...(prev?.contextSourceHash ? { contextSourceHash: prev.contextSourceHash } : {}),
+				...(prev?.lastBootstrap ? { lastBootstrap: prev.lastBootstrap } : {}),
+				...(prev?.lastInitAt ? { lastInitAt: prev.lastInitAt } : {}),
+				lastSessionAt: prev?.lastSessionAt ?? now,
+				lastIndexedAt: now,
+			});
+		},
 	});
+	if (!coordinated) throw new Error("codewiki index transaction did not commit");
+	const codewiki = coordinated.codewiki;
 	const indexed = indexedSourceCount(codewiki);
 	const coverage = profile.sourceFiles === 0 ? 1 : indexed / profile.sourceFiles;
 	const counts = languageCounts(profile);

package/src/cli/context.ts

@@ -1,3 +1,4 @@
+import { join, resolve } from "node:path";
 import type { BootstrapProgressEvent } from "../domains/context/index.js";
 import type { BootstrapGenerationState } from "../domains/context/state.js";
 
@@ -60,15 +61,19 @@ async function printContextStatus(): Promise<number> {
 	const preload = await import("../domains/prompts/preload.js");
 	const cwd = process.cwd();
 
-	const clio = context.tryReadClioMd(cwd);
+	const clio = context.loadProjectClioMd(cwd);
 	const state = context.readClioState(cwd);
-	const clioMdState = !clio
-		? "none"
-		: !clio.ok
-			? "malformed"
-			: state?.contextSources !== undefined && context.adoptionSourcesChanged(state.contextSources, { cwd })
-				? "stale"
-				: "ok";
+	const localStandardIsEffective = clio.files.some((file) => file.path === join(resolve(cwd), "CLIO-CODER.md"));
+	const clioMdState =
+		clio.files.length === 0 && clio.errors.length === 0
+			? "none"
+			: clio.errors.length > 0
+				? "malformed"
+				: localStandardIsEffective &&
+						state?.contextSources !== undefined &&
+						context.adoptionSourcesChanged(state.contextSources, { cwd })
+					? "stale"
+					: "ok";
 
 	const prompt = context.renderPromptContext(cwd);
 	const preloadClass = preload.classifyProjectPreload({

package/src/cli/default-target.ts

@@ -1,8 +1,6 @@
-import { readSettings } from "../core/config.js";
-import { openAuthStorage, resolveAuthTarget, targetRequiresAuth } from "../domains/providers/auth/index.js";
-import { isOrchestratorEligibleRuntime } from "../domains/providers/index.js";
-import { getRuntimeRegistry } from "../domains/providers/registry.js";
-import { registerBuiltinRuntimes } from "../domains/providers/runtimes/builtins.js";
+import { type ClioSettings, readSettings } from "../core/config.js";
+import { bootAuthStatus } from "../domains/providers/auth/boot-status.js";
+import { findBuiltinRuntimeBootMetadata } from "../domains/providers/runtimes/boot-manifest.js";
 
 /**
  * Why the configured chat target cannot be used, in the operator's terms
@@ -25,8 +23,7 @@ export type DefaultTargetVerdict =
 	| { kind: "ineligible-runtime"; targetId: string; runtime: string }
 	| { kind: "missing-credential"; targetId: string; store: string };
 
-export function classifyDefaultTarget(): DefaultTargetVerdict {
-	const settings = readSettings();
+export function classifyDefaultTarget(settings: Readonly<ClioSettings> = readSettings()): DefaultTargetVerdict {
 	const targetId = settings.orchestrator.target;
 	if (!targetId) return { kind: "no-target" };
 	// A chat target naming an id that is not in `targets` cannot arrive here:
@@ -36,18 +33,13 @@ export function classifyDefaultTarget(): DefaultTargetVerdict {
 	// it would be a case no settings file can produce.
 	const target = settings.targets.find((entry) => entry.id === targetId);
 	if (!target) return { kind: "no-target" };
-	const registry = getRuntimeRegistry();
-	if (registry.list().length === 0) registerBuiltinRuntimes(registry);
-	const runtime = registry.get(target.runtime);
-	if (!runtime || !isOrchestratorEligibleRuntime(runtime)) {
+	const runtime = findBuiltinRuntimeBootMetadata(target.runtime);
+	if (runtime?.kind !== "http") {
 		return { kind: "ineligible-runtime", targetId, runtime: target.runtime };
 	}
-	if (!targetRequiresAuth(target, runtime)) return { kind: "usable" };
-	const authTarget = resolveAuthTarget(target, runtime);
-	if (openAuthStorage().statusForTarget(authTarget, { includeFallback: false }).available) {
-		return { kind: "usable" };
-	}
-	return { kind: "missing-credential", targetId, store: authTarget.providerId };
+	const auth = bootAuthStatus(target, runtime);
+	if (auth.available) return { kind: "usable" };
+	return { kind: "missing-credential", targetId, store: auth.providerId };
 }
 
 /** One sentence naming what is wrong, for the causes target selection can fix. */

package/src/cli/docs.ts

@@ -19,9 +19,11 @@ const HOST = "127.0.0.1";
 
 const HELP = `clio-coder docs [topic] [--no-open]
 
-Serve Clio Coder's bundled HTML documentation locally and open it in a browser.
-The server binds an ephemeral port on 127.0.0.1 only; it keeps no state, runs no
-daemon, and reaches no external network. Press Ctrl+C to stop it.
+Serve Clio Coder's interactive HTML documentation locally and open it in a
+browser. The blueprints live in docs/html of a source checkout; the npm package
+ships the Markdown guides in docs/ only. The server binds an ephemeral port on
+127.0.0.1, keeps no state, runs no daemon, and reaches no external network.
+Press Ctrl+C to stop it.
 
 Arguments:
   [topic]      deep-link a specific blueprint (for example: safety, configuration,
@@ -62,7 +64,7 @@ export interface DocsMenuEntry {
 	label: string;
 }
 
-/** Resolve the bundled docs/html directory from the installed package root. */
+/** Resolve docs/html from the package root; present in a source checkout, absent from the npm package. */
 export function resolveDocsHtmlDir(): string {
 	return resolve(resolvePackageRoot(), "docs", "html");
 }
@@ -307,7 +309,11 @@ export async function runDocsCommand(args: ReadonlyArray<string> = []): Promise<
 	}
 	const files = listHtmlFiles(htmlDir);
 	if (files.length === 0) {
-		printError(`no bundled HTML docs found at ${htmlDir}`);
+		printError(`no HTML docs at ${htmlDir}`);
+		process.stdout.write(
+			`  the npm package ships the Markdown guides only: ${resolve(resolvePackageRoot(), "docs")}\n` +
+				"  the interactive blueprints are in a source checkout and at https://github.com/iowarp/clio-coder/tree/main/docs/html\n",
+		);
 		return 1;
 	}
 

package/src/cli/evidence.ts

@@ -110,7 +110,10 @@ export async function runEvidenceCommand(args: ReadonlyArray<string>): Promise<n
 		parsed = parseEvidenceArgs(args);
 	} catch (error) {
 		printError(error instanceof Error ? error.message : String(error));
-		process.stdout.write(HELP);
+		// Usage that accompanies an error goes to stderr with it. Splitting the
+		// two put the error on stderr and the usage on stdout, so a caller
+		// capturing stdout for evidence output collected a help screen instead.
+		process.stderr.write(HELP);
 		return 2;
 	}
 	if (parsed.help) {

package/src/cli/extensions.ts

@@ -125,10 +125,19 @@ export function runExtensionsCommand(argv: ReadonlyArray<string>): number {
 		process.stderr.write(HELP);
 		return 2;
 	}
-	if (parsed.help || !parsed.command) {
+	if (parsed.help) {
 		process.stdout.write(HELP);
 		return 0;
 	}
+	// A bare `clio-coder extensions` is a missing required argument, which the
+	// exit-code contract puts at 2 with the usage on stderr. It used to print the
+	// same help `--help` prints and exit 0, so a CI step gated on it went on to
+	// the next line; `eval`, `memory`, `evidence`, and `usage` all already
+	// answered 2 here.
+	if (!parsed.command) {
+		process.stderr.write(HELP);
+		return 2;
+	}
 	const scopeOptions = { ...(parsed.scope ? { scope: parsed.scope } : {}) };
 	switch (parsed.command) {
 		case "list": {

package/src/cli/fleet.ts

@@ -15,6 +15,7 @@
 import { randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { attributeCommitMessage } from "../core/commit-attribution.js";
 import { loadDomains } from "../core/domain-loader.js";
 import { clioStateDir } from "../core/xdg.js";
 import type { AgentsContract } from "../domains/agents/contract.js";
@@ -33,8 +34,9 @@ import {
 	renderFleetPrompt,
 	resultContractAuthorship,
 } from "../domains/agents/index.js";
+import type { ConfigContract } from "../domains/config/contract.js";
 import { ConfigDomainModule } from "../domains/config/index.js";
-import { ContextDomainModule } from "../domains/context/index.js";
+import { ContextDomainModule } from "../domains/context/runtime.js";
 import { type CapacityDrain, capacityDrain, setCapacityDraining } from "../domains/dispatch/capacity-lease.js";
 import { runCodeStep } from "../domains/dispatch/code-step.js";
 import { codeStepDir, writeCodeStepRecord } from "../domains/dispatch/code-step-store.js";
@@ -51,6 +53,7 @@ import {
 	withAttemptRole,
 } from "../domains/dispatch/execution-role.js";
 import { type ExecutionPlanResult, executePlan } from "../domains/dispatch/execution-scheduler.js";
+import { deriveFleetCommitAttribution } from "../domains/dispatch/fleet-commit-attribution.js";
 import { compileFleetExecutionPlan } from "../domains/dispatch/fleet-plan.js";
 import {
 	decideReviewGate,
@@ -162,7 +165,13 @@ function listingLine(entry: FleetContractListing, state: string, detail: string)
 	return `${entry.name}  ${entry.source}  ${state.padEnd(7)}  ${detail}\n`;
 }
 
-function runList(): number {
+function runList(args: ReadonlyArray<string>): number {
+	// `list` took no arguments and silently ignored whatever followed it, so
+	// `fleet list --bogus` exited 0 with the normal table and `fleet list --json`
+	// printed the human one. Its siblings status, drain, and resume all reject an
+	// unrecognised flag, and so do `agents` and `models`.
+	const unknown = args[0];
+	if (unknown !== undefined) return fail(`list: unknown flag: ${unknown}`);
 	const listings = listFleetContracts(process.cwd());
 	if (listings.length === 0) {
 		process.stdout.write("no fleet contracts found (.clio-coder/fleets/*.md)\n");
@@ -290,6 +299,7 @@ async function runFleet(args: ReadonlyArray<string>): Promise<number> {
 	]);
 	const dispatch = loaded.getContract<DispatchContract>("dispatch");
 	const agents = loaded.getContract<AgentsContract>("agents");
+	const config = loaded.getContract<ConfigContract>("config");
 	const safety = loaded.getContract<SafetyContract>("safety");
 	const scheduling = loaded.getContract<SchedulingContract>("scheduling");
 	if (!dispatch || !agents || !safety) {
@@ -360,6 +370,13 @@ async function runFleet(args: ReadonlyArray<string>): Promise<number> {
 	const receipts: RunReceipt[] = [];
 	const receiptsByStep = new Map<string, RunReceipt>();
 	const planStep = (stepId: string) => plan.steps.find((entry) => entry.id === stepId);
+	const attributionEnabled = config?.get().attribution.gitCommits ?? true;
+	// Freshness is coordinator-owned execution state. Worker prose cannot set
+	// either flag: a successful deterministic verification sets the first, and
+	// an integrity-valid independent gate decision sets the second. Any later
+	// workspace agent invalidates both before a commit may read them.
+	let validationFresh = false;
+	let independentReviewFresh = false;
 
 	/**
 	 * The commit message is the words of the agent that produced the work, and
@@ -455,6 +472,10 @@ async function runFleet(args: ReadonlyArray<string>): Promise<number> {
 				return {
 					assignmentId: handle.runId,
 					result: handle.finalPromise.then((receipt) => {
+						if (step.scope === "workspace") {
+							validationFresh = false;
+							independentReviewFresh = false;
+						}
 						receipts.push(receipt);
 						receiptsByStep.set(step.id, receipt);
 						const envelope = dispatch.getRun(receipt.runId);
@@ -481,19 +502,37 @@ async function runFleet(args: ReadonlyArray<string>): Promise<number> {
 				const command = commands?.commands.get(step.commandId);
 				if (command === undefined) throw new Error(`fleet code step '${step.id}' has no registered command`);
 				const isCommit = step.commitFrom !== undefined;
+				const evidence = isCommit
+					? deriveFleetCommitAttribution({
+							plan,
+							step,
+							priorResults,
+							validationFresh,
+							independentReviewFresh,
+						})
+					: null;
+				if (!isCommit && step.scope === "workspace" && step.verification !== true) {
+					validationFresh = false;
+					independentReviewFresh = false;
+				}
+				const originalMessage = isCommit ? commitMessageFor(step, priorResults) : null;
 				const outcome = await runCodeStep({
 					stepId: step.id,
 					command,
 					workspaceRoot: process.cwd(),
 					artifactDir: codeStepDir(fleetRootId),
 					signal,
-					...(isCommit
+					...(isCommit && evidence !== null && originalMessage !== null
 						? {
-								substitutions: { commitMessage: commitMessageFor(step, priorResults) },
+								substitutions: {
+									commitMessage: attributeCommitMessage(originalMessage, evidence, attributionEnabled),
+								},
 								requireWorkspaceChanges: true,
+								commitAttribution: { enabled: attributionEnabled, evidence },
 							}
 						: {}),
 				});
+				if (step.verification === true) validationFresh = outcome.report.passed;
 				const recordPath = await writeCodeStepRecord(fleetRootId, outcome.record);
 				if (json) process.stdout.write(`${JSON.stringify({ codeStep: outcome.record })}\n`);
 				else
@@ -534,15 +573,17 @@ async function runFleet(args: ReadonlyArray<string>): Promise<number> {
 						needsDecision: `loop '${loop.id}' cycle ${attempt} has no sealed reviewer or subject receipt`,
 					};
 				}
+				const correlation = fleetGateCorrelation(subject, decider);
 				const decided = decideReviewGate({
 					group: `${fleetRootId}:${loop.id}`,
 					cycle: attempt,
 					terminalCycle: terminalAttempt,
 					subjects: [{ runId: subject.runId, digest: subject.integrity.digest }],
 					decider: { runId: decider.runId, digest: decider.integrity.digest },
-					correlation: fleetGateCorrelation(subject, decider),
+					correlation,
 					output: result.output,
 				});
+				independentReviewFresh = decided.verdict === "pass" && correlation.independent;
 				const staged = stagePendingGateDecision(decided.draft);
 				const { path: decisionPath } = materializePendingGateDecision(staged);
 				if (!json) {
@@ -810,7 +851,7 @@ export async function runFleetCommand(args: ReadonlyArray<string>): Promise<numb
 	}
 	switch (sub) {
 		case "list":
-			return runList();
+			return runList(args.slice(1));
 		case "run":
 			return runFleet(args.slice(1));
 		case "status":