@iowarp/clio-coder 0.4.2 → 0.4.3

package/src/domains/dispatch/budget-envelope.ts

@@ -28,6 +28,17 @@ export interface BudgetEnvelopeReason {
 
 export interface RunToolBudgetEnvelope {
 	version: 1;
+	enforcement:
+		| {
+				classification: "native-per-tool";
+				perTool: "enforced";
+				clioControls: ReadonlyArray<"tool-calls" | "read-reserve" | "synthesis" | "attempt-cap">;
+		  }
+		| {
+				classification: "external-one-shot";
+				perTool: "unobserved-not-enforced";
+				clioControls: ReadonlyArray<"single-launch" | "wall-clock" | "output-cap" | "cancellation" | "result-contract">;
+		  };
 	policy: {
 		recipeId: string;
 		default: AgentBudgetPhase & { synthesis: boolean };
@@ -39,6 +50,15 @@ export interface RunToolBudgetEnvelope {
 	reasons: ReadonlyArray<BudgetEnvelopeReason>;
 }
 
+const NATIVE_CLIO_CONTROLS = ["tool-calls", "read-reserve", "synthesis", "attempt-cap"] as const;
+const EXTERNAL_CLIO_CONTROLS = [
+	"single-launch",
+	"wall-clock",
+	"output-cap",
+	"cancellation",
+	"result-contract",
+] as const;
+
 export type BudgetAdmissionDenialCode =
 	| "exact-recipe-policy"
 	| "recipe-maximum"
@@ -94,6 +114,8 @@ export function cloneDispatchBudgetRequest(value: unknown, prefix = "budget"): D
 }
 
 function freezeEnvelope(envelope: RunToolBudgetEnvelope): RunToolBudgetEnvelope {
+	Object.freeze(envelope.enforcement.clioControls);
+	Object.freeze(envelope.enforcement);
 	Object.freeze(envelope.policy.default);
 	Object.freeze(envelope.policy.maximum);
 	Object.freeze(envelope.policy);
@@ -172,6 +194,7 @@ export interface ResolveToolBudgetEnvelopeInput {
 	hasReadTool: boolean;
 	retry: boolean;
 	revision: boolean;
+	enforcement?: "native-per-tool" | "external-one-shot";
 }
 
 /** Resolve the one immutable envelope used by admission, enforcement, and evidence. */
@@ -253,6 +276,18 @@ export function resolveToolBudgetEnvelope(input: ResolveToolBudgetEnvelopeInput)
 	const authoredMaximum = input.policy.maximum ?? input.policy;
 	return freezeEnvelope({
 		version: 1,
+		enforcement:
+			input.enforcement === "external-one-shot"
+				? {
+						classification: "external-one-shot",
+						perTool: "unobserved-not-enforced",
+						clioControls: [...EXTERNAL_CLIO_CONTROLS],
+					}
+				: {
+						classification: "native-per-tool",
+						perTool: "enforced",
+						clioControls: [...NATIVE_CLIO_CONTROLS],
+					},
 		policy: {
 			recipeId: input.recipeId,
 			default: {
@@ -297,7 +332,11 @@ export function formatEffectiveBudget(envelope: RunToolBudgetEnvelope): string {
 	const revision = budget.revision
 		? `, result revision ${budget.revision.toolCalls}/${budget.revision.readReserve}`
 		: "";
-	return `${budget.toolCalls}/${budget.readReserve}${revision}, lifetime cap ${budget.hardCap}, synthesis=${budget.synthesis ? "on" : "off"}`;
+	const enforcement =
+		envelope.enforcement.classification === "external-one-shot"
+			? "external one-shot; per-tool unobserved/not enforced"
+			: "native per-tool enforced";
+	return `${budget.toolCalls}/${budget.readReserve}${revision}, lifetime cap ${budget.hardCap}, synthesis=${budget.synthesis ? "on" : "off"}; ${enforcement}`;
 }
 
 export function formatBudgetReasons(envelope: RunToolBudgetEnvelope): string {
@@ -314,6 +353,10 @@ const BUDGET_REASON_CODES: ReadonlySet<string> = new Set<BudgetEnvelopeReasonCod
 	"revision-growth-denied",
 ]);
 
+function isExactStringArray(value: unknown[], expected: readonly string[]): boolean {
+	return value.length === expected.length && value.every((item, index) => item === expected[index]);
+}
+
 /** Safely project an envelope that crossed a persistence or event boundary. */
 export function cloneRunToolBudgetEnvelope(value: unknown): RunToolBudgetEnvelope | undefined {
 	try {
@@ -373,8 +416,50 @@ export function cloneRunToolBudgetEnvelope(value: unknown): RunToolBudgetEnvelop
 			}
 			reasons.push({ code: reason.code as BudgetEnvelopeReasonCode, detail: reason.detail });
 		}
+		const enforcement = (() => {
+			if (value.enforcement === undefined) {
+				return {
+					classification: "native-per-tool" as const,
+					perTool: "enforced" as const,
+					clioControls: [...NATIVE_CLIO_CONTROLS],
+				};
+			}
+			if (!isRecord(value.enforcement) || !Array.isArray(value.enforcement.clioControls)) return null;
+			if (
+				Object.keys(value.enforcement).some(
+					(key) => key !== "classification" && key !== "perTool" && key !== "clioControls",
+				)
+			) {
+				return null;
+			}
+			if (
+				value.enforcement.classification === "external-one-shot" &&
+				value.enforcement.perTool === "unobserved-not-enforced" &&
+				isExactStringArray(value.enforcement.clioControls, EXTERNAL_CLIO_CONTROLS)
+			) {
+				return {
+					classification: "external-one-shot" as const,
+					perTool: "unobserved-not-enforced" as const,
+					clioControls: [...EXTERNAL_CLIO_CONTROLS],
+				};
+			}
+			if (
+				value.enforcement.classification === "native-per-tool" &&
+				value.enforcement.perTool === "enforced" &&
+				isExactStringArray(value.enforcement.clioControls, NATIVE_CLIO_CONTROLS)
+			) {
+				return {
+					classification: "native-per-tool" as const,
+					perTool: "enforced" as const,
+					clioControls: [...NATIVE_CLIO_CONTROLS],
+				};
+			}
+			return null;
+		})();
+		if (enforcement === null) return undefined;
 		return freezeEnvelope({
 			version: 1,
+			enforcement,
 			policy: {
 				recipeId,
 				default: { ...defaultPhase, synthesis: value.policy.default.synthesis },

package/src/domains/dispatch/capability-match.ts

@@ -76,6 +76,7 @@ const REPORTING_CONTRACT_KINDS: ReadonlySet<ResultContract["kind"]> = new Set([
 	"scout-report",
 	"verifier-report",
 	"research-report",
+	"world-knowledge-report",
 	"provenance-report",
 	"debugger-report",
 	"oracle-report",

package/src/domains/dispatch/capacity-lease.ts

@@ -481,6 +481,23 @@ export function capacityLeaseUsage(options?: { nowMs?: number; probe?: LeaseOwne
 	return { global: leases.length, nodes, endpoints, endpointHolders };
 }
 
+/** Coherent current endpoint occupancy, including held reservation waves.
+ * The caller still owns admission; process-local streams are not global leases.
+ */
+export function endpointCapacityUsage(): Readonly<Record<string, number>> {
+	return withStateFileLockSync(capacityStateLockPath(), () => {
+		const file = readCapacityStateUnsafe();
+		reclaim(file, Date.now(), defaultProbe);
+		const held = heldReservationUsage(file.reservations);
+		const usage: Record<string, number> = { ...foregroundStreamUsage() };
+		for (const [key, count] of Object.entries(held.endpoints)) usage[key] = (usage[key] ?? 0) + count;
+		for (const lease of file.leases) {
+			if (lease.endpointKey !== undefined) usage[lease.endpointKey] = (usage[lease.endpointKey] ?? 0) + 1;
+		}
+		return usage;
+	});
+}
+
 /**
  * Per-node lease counts for display and for advisory placement spreading. Every
  * read takes the admission state lock, so a render loop or a multi-node

package/src/domains/dispatch/contract.ts

@@ -86,6 +86,12 @@ export interface DispatchAdmissionObserver {
 	onAdmitted(run: { runId: string; pid: number | null; runtimeKind: RunEnvelope["runtimeKind"] }): void;
 }
 
+/** Invocation-owned admission bounds; never serialized into model-authored requests. */
+export interface DispatchPreparationOptions {
+	signal?: AbortSignal;
+	deadlineAt?: number;
+}
+
 /** Side-effect-free effective routing used to construct a dispatch approval artifact. */
 export interface DispatchPlanTaskResolution {
 	agentId: string;
@@ -225,6 +231,7 @@ export interface DispatchContract {
 	dispatch(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
@@ -232,7 +239,10 @@ export interface DispatchContract {
 	}>;
 
 	/** Spawn a group of dispatches and expose one merged batch event stream. */
-	dispatchBatch(reqs: ReadonlyArray<DispatchRequest>): Promise<{
+	dispatchBatch(
+		reqs: ReadonlyArray<DispatchRequest>,
+		preparation?: DispatchPreparationOptions,
+	): Promise<{
 		batchId: string;
 		/** Logical work ids, one per request in admission order. */
 		assignmentIds: ReadonlyArray<string>;

package/src/domains/dispatch/extension.ts

@@ -16,6 +16,7 @@ import { performance } from "node:perf_hooks";
 import { BusChannels, type DispatchCompletedPayload, type DispatchRunIdentity } from "../../core/bus-events.js";
 import { DEFAULT_SETTINGS, type DelegationToolGovernance } from "../../core/defaults.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
+import { gatewayRoutingObservationFromRecord } from "../../core/gateway-routing.js";
 import { GUARDRAIL_DEFAULTS } from "../../core/guardrails.js";
 import { readClioVersion, readPiMonoVersion } from "../../core/package-root.js";
 import { canonicalizeExistingPath } from "../../core/path-canonical.js";
@@ -158,6 +159,7 @@ import type {
 	DispatchAdmissionObserver,
 	DispatchContract,
 	DispatchPlanTaskResolution,
+	DispatchPreparationOptions,
 	DispatchRequest,
 	DispatchSnapshot,
 } from "./contract.js";
@@ -297,6 +299,7 @@ import {
 	validateJobSpec,
 } from "./validation.js";
 import { describeUngroundedValidations, groundClaimedValidations, invalidatesQuality } from "./validation-grounding.js";
+import { prepareWorkerModelMetadata } from "./worker-model-metadata.js";
 import {
 	type AgentLedgerBody,
 	computeSettingsFingerprint,
@@ -1439,6 +1442,13 @@ function runtimeLimitations(runtimeKind: RunKind, runtimeId: string): string[] {
 			"Claude CLI subprocess executes Claude Code tools; Clio constrains permission mode and forbids dangerous bypass unless explicitly gated",
 		];
 	}
+	if (runtimeKind === "subprocess" && runtimeId === "antigravity-code") {
+		return [
+			"Antigravity CLI owns its internal tools, network activity, prompts, and approvals; Clio observes only structured stream output and does not provide per-tool mediation or complete tool telemetry",
+			"Antigravity conversation ids are recorded only as opaque provider observations; Clio does not resume them",
+			"Antigravity runs are one-shot and never retried automatically",
+		];
+	}
 	// HTTP/native runtimes run through pi-agent-core, which Clio observes and
 	// controls directly, so there are no runtime-imposed dispatch limitations.
 	return [];
@@ -1479,13 +1489,6 @@ function assertWriteRootsEnforceable(runtime: RuntimeDescriptor, writeRoots: Rea
 	);
 }
 
-function assertWorkerBudgetEnforceable(runtime: RuntimeDescriptor, hasDeclaredBudget: boolean): void {
-	if (!hasDeclaredBudget || runtime.kind !== "subprocess") return;
-	throw new Error(
-		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
-	);
-}
-
 /**
  * API families whose wire protocol carries tool calls. Membership is a property
  * of the protocol, not of any one model: every server speaking one of these can
@@ -1614,13 +1617,38 @@ function workerToolCallHardCap(settings: EffectiveSettings): number {
 	return settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap;
 }
 
+/**
+ * Only a runtime that declares its external agent loop may accept a declared
+ * per-tool budget: Clio records that budget as unobserved rather than enforced.
+ * Any other subprocess runtime cannot mediate tool calls, so a declared budget
+ * would be a claim nobody enforces.
+ */
+export function assertWorkerBudgetEnforceable(
+	runtime: Pick<RuntimeDescriptor, "id" | "kind" | "externalAgentLoop">,
+	hasDeclaredBudget: boolean,
+): void {
+	if (!hasDeclaredBudget || runtime.kind !== "subprocess" || runtime.externalAgentLoop !== undefined) return;
+	throw new Error(
+		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
+	);
+}
+
+/** Per-tool budget enforcement is real only where Clio observes each tool call. */
+export function budgetEnforcementForRuntime(
+	runtime: Pick<RuntimeDescriptor, "kind">,
+): "native-per-tool" | "external-one-shot" {
+	return runtime.kind === "subprocess" ? "external-one-shot" : "native-per-tool";
+}
+
 function resolveEffectiveWorkerBudget(input: {
 	req: DispatchRequest;
 	recipeId: string;
 	declared: ReturnType<typeof normalizeAgentSpec>["budget"];
 	allowedTools: ReadonlyArray<ToolName>;
 	settings: EffectiveSettings;
+	runtime: RuntimeDescriptor;
 }): RunToolBudgetEnvelope {
+	assertWorkerBudgetEnforceable(input.runtime, input.declared !== null || input.req.budget !== undefined);
 	const hardCap = workerToolCallHardCap(input.settings);
 	const declared = input.declared ?? {
 		toolCalls: hardCap,
@@ -1635,6 +1663,7 @@ function resolveEffectiveWorkerBudget(input: {
 		hasReadTool: input.allowedTools.includes(ToolNames.Read),
 		retry: (input.req.lineage?.attempt ?? 0) > 0,
 		revision: input.req.gate?.role === "builder" && input.req.gate.cycle > 1 && input.req.gate.verdict === "revise",
+		enforcement: budgetEnforcementForRuntime(input.runtime),
 	});
 }
 
@@ -1975,6 +2004,15 @@ function clampWorkerAutonomy(session: AutonomyLevel, requested: AutonomyLevel |
 	return AUTONOMY_ORDER[requested] < AUTONOMY_ORDER[session] ? requested : session;
 }
 
+/** Read-only recipes are an authority boundary, including on opaque external loops. */
+export function effectiveWorkerAutonomy(
+	session: AutonomyLevel,
+	requested: AutonomyLevel | undefined,
+	capabilityClass: AgentCapabilityClass,
+): AutonomyLevel {
+	return clampWorkerAutonomy(session, capabilityClass === "read-only" ? "read-only" : requested);
+}
+
 function requestedAutonomyEvidence(
 	sessionAutonomy: AutonomyLevel,
 	requestedAutonomy: AutonomyLevel | undefined,
@@ -2662,6 +2700,7 @@ export function createDispatchBundle(
 		nodeId: string,
 		timing: RunPhaseMarks,
 		endpoint?: EndpointCapacity | null,
+		signal?: AbortSignal,
 	) {
 		const queuedAt = now();
 		timing.queuedAt = new Date(queuedAt).toISOString();
@@ -2677,7 +2716,12 @@ export function createDispatchBundle(
 				: planQueueSlot(req.reservation.ownerId, req.reservation.memberId, (error) =>
 						reportDispatchDiagnostic("read plan queue identity", error),
 					);
+		const cancel = (): void => {
+			capacityAdmission.cancel(assignmentId);
+		};
+		signal?.addEventListener("abort", cancel, { once: true });
 		try {
+			signal?.throwIfAborted();
 			const admitted = await capacityAdmission.admit({
 				assignmentId,
 				nodeId,
@@ -2700,6 +2744,8 @@ export function createDispatchBundle(
 				else await failQueuedAssignment(assignmentId);
 			}
 			throw error;
+		} finally {
+			signal?.removeEventListener("abort", cancel);
 		}
 	}
 
@@ -2849,6 +2895,14 @@ export function createDispatchBundle(
 		if (draining) return { scheduled: false };
 		const rootRunId = run.lineage.rootRunId;
 		if (!retryChainIsLive(run)) return { scheduled: false };
+		if (providers.getRuntime(run.runtimeId)?.externalAgentLoop?.generatingRetry === "forbidden") {
+			retryBackoff.delete(rootRunId);
+			return {
+				scheduled: false,
+				settlementDetail:
+					"automatic retry suppressed because this external agent loop is one-shot and Clio cannot prove replay is side-effect-free",
+			};
+		}
 		if (!RETRYABLE_OUTCOMES.has(outcome)) {
 			retryBackoff.delete(rootRunId);
 			return { scheduled: false };
@@ -3224,6 +3278,9 @@ export function createDispatchBundle(
 		const tickMonotonic = monotonicNow();
 		for (const run of active.values()) {
 			if (run.aborted || run.stallKilled || !run.heartbeatAt) continue;
+			// Finalizers retain active entries while awaiting ledger persistence.
+			// Their terminal status is already sealed into the receipt digest.
+			if (ledger.get(run.runId)?.endedAt !== null) continue;
 			const heartbeatMonotonic = heartbeatMonotonicAt(run.heartbeatAt);
 			if (!Number.isFinite(heartbeatMonotonic) || !Number.isFinite(run.heartbeatAt.current)) continue;
 			if (run.runtimeKind === "acp-delegation") {
@@ -3415,7 +3472,12 @@ export function createDispatchBundle(
 		}
 	}
 
-	async function resolveLifecycle(req: DispatchRequest, settings: EffectiveSettings): Promise<DispatchLifecycleStage> {
+	async function resolveLifecycle(
+		req: DispatchRequest,
+		settings: EffectiveSettings,
+		metadataDeadlineAt: number,
+		signal?: AbortSignal,
+	): Promise<DispatchLifecycleStage> {
 		const recipe = agents.get(req.agentId);
 		if (!recipe) {
 			throw new Error(`dispatch: unknown agent recipe: ${req.agentId}`);
@@ -3453,22 +3515,35 @@ export function createDispatchBundle(
 		publishDispatchPathScope(req, pathScope);
 		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
-		const target = resolveDispatchTarget(
-			req,
-			recipe,
-			targets.workerDefault,
-			targets.workerProfiles,
-			targets.agentBindings,
-			targets.targetOrder,
-			providers,
-		);
+		const resolveTarget = () =>
+			resolveDispatchTarget(
+				req,
+				recipe,
+				targets.workerDefault,
+				targets.workerProfiles,
+				targets.agentBindings,
+				targets.targetOrder,
+				providers,
+			);
+		let target = resolveTarget();
+		const identity = (resolved: ResolvedTarget): string =>
+			JSON.stringify([
+				resolved.target.id,
+				resolved.runtime.id,
+				resolved.wireModelId,
+				endpointIdentityHash(resolved.target.url),
+			]);
+		const selectedIdentity = identity(target);
+		await prepareWorkerModelMetadata(providers, target.target.id, metadataDeadlineAt, signal, now);
+		target = resolveTarget();
+		if (identity(target) !== selectedIdentity) {
+			throw new Error("dispatch: worker route changed during model metadata preparation; request a fresh admission");
+		}
 		enforceCapabilityGate(target.target.id, target.modelCapabilities, req.requiredCapabilities);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.fleet.permissions.mode ?? "deny");
-		assertWorkerBudgetEnforceable(target.runtime, spec.budget !== null || req.budget !== undefined);
-
 		const cwd = req.cwd ?? process.cwd();
 		const sessionAutonomy = settings?.safety.autonomy ?? "auto-edit";
-		const effectiveAutonomy = clampWorkerAutonomy(sessionAutonomy, req.autonomy);
+		const effectiveAutonomy = effectiveWorkerAutonomy(sessionAutonomy, req.autonomy, spec.capabilityClass);
 		const effectiveTools = withLedgerToolNarrowing(
 			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
@@ -3507,6 +3582,7 @@ export function createDispatchBundle(
 			declared: spec.budget,
 			allowedTools: effectiveTools,
 			settings,
+			runtime: target.runtime,
 		});
 		// Fetch structured project context only for tiers that receive it, so
 		// read-only scouts never pay the CLIO-CODER.md read. The tier is spec policy
@@ -3827,11 +3903,13 @@ export function createDispatchBundle(
 				const responseModelIdObservation = responseModelIdObservationFromRecord(event.message, "not-observed");
 				const differingResponseModelId = readStringOrNull(event.message.responseModel);
 				const providerResponseId = readStringOrNull(event.message.responseId);
+				const gatewayRouting = gatewayRoutingObservationFromRecord(event.message);
 				upstreamResponses.push({
 					requestedModelId,
 					responseModelIdObservation,
 					differingResponseModelId,
 					providerResponseId,
+					...(gatewayRouting !== null ? { gatewayRouting } : {}),
 				});
 				if (event.message.stopReason === "error") {
 					const message = readStringOrNull(event.message.errorMessage);
@@ -4389,6 +4467,7 @@ export function createDispatchBundle(
 	async function dispatchAttempt(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
 		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
@@ -4494,7 +4573,10 @@ export function createDispatchBundle(
 		}
 
 		req = routeAroundCoolingTarget(req, settings) ?? req;
-		const lifecycle = await resolveLifecycle(req, settings);
+		const metadataDeadlineAt =
+			req.assignmentDeadlineAt ?? Date.parse(requestedAt) + (req.routingIntent?.deadlineMs ?? 60_000);
+		const lifecycle = await resolveLifecycle(req, settings, metadataDeadlineAt, preparation?.signal);
+		preparation?.signal?.throwIfAborted();
 		timing.decisionCompletedAt = new Date(now()).toISOString();
 		assertResponseSchemaEnforceable(
 			lifecycle.target.runtime,
@@ -4571,7 +4653,13 @@ export function createDispatchBundle(
 		if (queuedIdentity !== null) publishCapacityQueued(queuedIdentity, timing, placement?.node ?? null);
 		let capacityLease: Awaited<ReturnType<typeof admitAssignmentCapacity>>;
 		try {
-			capacityLease = await admitAssignmentCapacity(req, placement?.node.id ?? "local", timing, endpoint);
+			capacityLease = await admitAssignmentCapacity(
+				req,
+				placement?.node.id ?? "local",
+				timing,
+				endpoint,
+				preparation?.signal,
+			);
 		} catch (error) {
 			if (queuedIdentity !== null) publishCapacityAdmissionFailure(queuedIdentity, error);
 			throw error;
@@ -4582,6 +4670,7 @@ export function createDispatchBundle(
 
 		const ledgerRef = (() => {
 			try {
+				preparation?.signal?.throwIfAborted();
 				return requireLedger();
 			} catch (error) {
 				leaseSlot.release();
@@ -4644,6 +4733,7 @@ export function createDispatchBundle(
 		};
 		let worker: SpawnedWorker;
 		try {
+			preparation?.signal?.throwIfAborted();
 			worker = (placement?.spawn ?? spawnWorker)(spec, {
 				cwd: lifecycle.cwd,
 				now,
@@ -4865,11 +4955,13 @@ export function createDispatchBundle(
 				const responseModelIdObservation = responseModelIdObservationFromRecord(event.message, "not-observed");
 				const differingResponseModelId = readStringOrNull(event.message.responseModel);
 				const providerResponseId = readStringOrNull(event.message.responseId);
+				const gatewayRouting = gatewayRoutingObservationFromRecord(event.message);
 				upstreamResponses.push({
 					requestedModelId,
 					responseModelIdObservation,
 					differingResponseModelId,
 					providerResponseId,
+					...(gatewayRouting !== null ? { gatewayRouting } : {}),
 				});
 				if (event.message.stopReason === "error") {
 					const message = readStringOrNull(event.message.errorMessage);
@@ -5493,7 +5585,9 @@ export function createDispatchBundle(
 					reachedTerminalResult: resultContractWasDue(finalOutcome, outcomeCode),
 					output: capturedOutput?.state === "final" ? capturedOutput.text : null,
 					cwd: lifecycle.cwd,
-					networkAllowed: lifecycle.admission.allowedTools.includes(ToolNames.WebFetch),
+					networkAllowed:
+						lifecycle.admission.allowedTools.includes(ToolNames.WebFetch) ||
+						lifecycle.target.runtime.externalAgentLoop?.network === "externally-governed-unobserved",
 					observedRunEffects,
 					filesystem: nodeResultContractFilesystem(),
 				});
@@ -5754,13 +5848,20 @@ export function createDispatchBundle(
 	async function dispatch(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
 		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
 		finalPromise: Promise<RunReceipt>;
 	}> {
-		let prepared = req;
+		let prepared =
+			preparation?.deadlineAt === undefined
+				? req
+				: {
+						...req,
+						assignmentDeadlineAt: Math.min(req.assignmentDeadlineAt ?? Number.POSITIVE_INFINITY, preparation.deadlineAt),
+					};
 		let createdWorktree: DispatchRequest["taskWorktree"];
 		let writerLease: CheckoutWriterLease | undefined;
 		const writerRecipe = agents.get(req.agentId);
@@ -5792,7 +5893,7 @@ export function createDispatchBundle(
 				return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? entry : resolvePath(taskWorktree.path, rel);
 			});
 			prepared = {
-				...req,
+				...prepared,
 				runIdHint: runId,
 				taskWorktree,
 				cwd: workerCwd,
@@ -5802,7 +5903,8 @@ export function createDispatchBundle(
 		}
 		let handle: Awaited<ReturnType<typeof dispatchAttempt>>;
 		try {
-			handle = await dispatchAttempt(prepared, observer, settlement);
+			preparation?.signal?.throwIfAborted();
+			handle = await dispatchAttempt(prepared, observer, preparation, settlement);
 		} catch (error) {
 			writerLease?.release();
 			if (createdWorktree !== undefined) {
@@ -5929,7 +6031,6 @@ export function createDispatchBundle(
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, agentSpec, effectiveTools, target);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.fleet.permissions.mode ?? "deny");
-		assertWorkerBudgetEnforceable(target.runtime, agentSpec.budget !== null || req.budget !== undefined);
 		assertResponseSchemaEnforceable(target.runtime, target.modelCapabilities, req.responseSchema, effectiveTools.length);
 		assertWriteRootsEnforceable(target.runtime, pathScope.writeBoundaries);
 		assertProtectedArtifactsEnforceable(
@@ -5943,6 +6044,7 @@ export function createDispatchBundle(
 			declared: agentSpec.budget,
 			allowedTools: effectiveTools,
 			settings,
+			runtime: target.runtime,
 		});
 		const endpoint = endpointCapacityForTarget(target.target.id);
 		return {
@@ -6191,7 +6293,10 @@ export function createDispatchBundle(
 		})();
 	}
 
-	async function dispatchBatch(reqs: ReadonlyArray<DispatchRequest>): Promise<{
+	async function dispatchBatch(
+		reqs: ReadonlyArray<DispatchRequest>,
+		preparation?: DispatchPreparationOptions,
+	): Promise<{
 		batchId: string;
 		assignmentIds: ReadonlyArray<string>;
 		events: AsyncIterableIterator<unknown>;
@@ -6210,7 +6315,7 @@ export function createDispatchBundle(
 		const handles: Array<Awaited<ReturnType<typeof dispatch>> & { agentId: string }> = [];
 		try {
 			for (const req of reqs) {
-				const handle = await dispatch(req, undefined, settlement);
+				const handle = await dispatch(req, undefined, preparation, settlement);
 				handles.push({ ...handle, agentId: req.agentId });
 			}
 		} catch (err) {

package/src/domains/dispatch/types.ts

@@ -6,6 +6,7 @@
  * are pure data: no class methods, no engine refs.
  */
 
+import type { GatewayRoutingObservation } from "../../core/gateway-routing.js";
 import type { ResponseModelIdObservation } from "../../core/response-model-id.js";
 import type { SkillActivation } from "../../core/skill-activation.js";
 import type { ToolProfileName } from "../../tools/profiles.js";
@@ -652,6 +653,8 @@ export interface RunReceiptUpstreamResponse {
 	responseModelIdObservation: ResponseModelIdObservation;
 	differingResponseModelId: string | null;
 	providerResponseId: string | null;
+	/** Physical route and proxy attempts reported by LiteLLM, when this call used that gateway. */
+	gatewayRouting?: GatewayRoutingObservation;
 }
 
 /**

package/src/domains/dispatch/worker-model-metadata.ts

@@ -0,0 +1,38 @@
+import type { ProvidersContract } from "../providers/contract.js";
+
+/** Preparation owns its wait; a late HTTP body cannot start an expired worker. */
+export async function prepareWorkerModelMetadata(
+	providers: ProvidersContract,
+	targetId: string,
+	deadlineAt: number,
+	signal?: AbortSignal,
+	now: () => number = Date.now,
+): Promise<void> {
+	signal?.throwIfAborted();
+	const status = providers.list().find((entry) => entry.target.id === targetId);
+	if (status?.target.runtime !== "litellm" || status.health.lastCheckAt !== null) return;
+	const remainingMs = deadlineAt - now();
+	const deadlineError = new Error("dispatch: admission deadline expired during worker model metadata preparation");
+	if (remainingMs <= 0) throw deadlineError;
+	const controller = new AbortController();
+	const abort = (): void => controller.abort(signal?.reason);
+	signal?.addEventListener("abort", abort, { once: true });
+	const timer = setTimeout(() => controller.abort(deadlineError), Math.min(remainingMs, 2_147_483_647));
+	let rejectAborted!: (reason: unknown) => void;
+	const aborted = new Promise<never>((_resolve, reject) => {
+		rejectAborted = reject;
+	});
+	const onAbort = (): void => rejectAborted(controller.signal.reason);
+	controller.signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		// The provider also fences publication after each await. Promise.race
+		// observes the probe's eventual rejection if an HTTP body settles late.
+		await Promise.race([providers.probeTarget(targetId, { reasoning: false, signal: controller.signal }), aborted]);
+		controller.signal.throwIfAborted();
+		if (now() >= deadlineAt) throw deadlineError;
+	} finally {
+		clearTimeout(timer);
+		signal?.removeEventListener("abort", abort);
+		controller.signal.removeEventListener("abort", onAbort);
+	}
+}