@iowarp/clio-coder 0.4.2 → 0.4.4

package/src/domains/dispatch/extension.ts

@@ -16,6 +16,7 @@ import { performance } from "node:perf_hooks";
 import { BusChannels, type DispatchCompletedPayload, type DispatchRunIdentity } from "../../core/bus-events.js";
 import { DEFAULT_SETTINGS, type DelegationToolGovernance } from "../../core/defaults.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
+import { gatewayRoutingObservationFromRecord } from "../../core/gateway-routing.js";
 import { GUARDRAIL_DEFAULTS } from "../../core/guardrails.js";
 import { readClioVersion, readPiMonoVersion } from "../../core/package-root.js";
 import { canonicalizeExistingPath } from "../../core/path-canonical.js";
@@ -158,6 +159,7 @@ import type {
 	DispatchAdmissionObserver,
 	DispatchContract,
 	DispatchPlanTaskResolution,
+	DispatchPreparationOptions,
 	DispatchRequest,
 	DispatchSnapshot,
 } from "./contract.js";
@@ -297,6 +299,7 @@ import {
 	validateJobSpec,
 } from "./validation.js";
 import { describeUngroundedValidations, groundClaimedValidations, invalidatesQuality } from "./validation-grounding.js";
+import { prepareWorkerModelMetadata } from "./worker-model-metadata.js";
 import {
 	type AgentLedgerBody,
 	computeSettingsFingerprint,
@@ -841,14 +844,19 @@ function renderBoundSkillBlock(recipe: AgentRecipe): string {
 	].join("\n");
 }
 
-function workerPersonaBody(
-	req: DispatchRequest,
-	recipe: AgentRecipe | null,
-	allowedTools: ReadonlyArray<ToolName>,
-): string {
+/**
+ * Whether Clio's canonical `context` tool is attached to this worker. A
+ * subprocess runtime runs its own tool loop and never receives Clio's tool
+ * surface, so the recipe's `context` entry does not make the tool available
+ * there, and bound skills must not be promised through it.
+ */
+function canonicalContextAttached(runtime: Pick<RuntimeDescriptor, "kind">, tools: ReadonlyArray<ToolName>): boolean {
+	return runtime.kind !== "subprocess" && tools.includes(ToolNames.Context);
+}
+
+function workerPersonaBody(req: DispatchRequest, recipe: AgentRecipe | null, contextAttached: boolean): string {
 	const base = req.systemPrompt && req.systemPrompt.length > 0 ? req.systemPrompt : (recipe?.body ?? "");
-	const skillBlock =
-		recipe && req.noSkills !== true && allowedTools.includes(ToolNames.Context) ? renderBoundSkillBlock(recipe) : "";
+	const skillBlock = recipe && req.noSkills !== true && contextAttached ? renderBoundSkillBlock(recipe) : "";
 	return [base, skillBlock].filter((part) => part.trim().length > 0).join("\n\n");
 }
 
@@ -1347,6 +1355,8 @@ interface DispatchLifecycleStage {
 	pipeline: RunPipelineProvenance | null;
 	briefing: RunBriefingProvenance | null;
 	personaOverride: RunPersonaOverride | null;
+	/** Decision refs sealed on the request by the dispatch tool; null when the parent board was empty. */
+	decisionRefs: ReadonlyArray<string> | null;
 	projectContext: RunProjectContextProvenance;
 	/** Rule ids the worker prompt compiler selected into this run's system prompt; [] when none matched. */
 	rulesApplied: string[];
@@ -1379,6 +1389,8 @@ interface AcpDelegationLifecycleStage {
 	pipeline: RunPipelineProvenance | null;
 	briefing: RunBriefingProvenance | null;
 	personaOverride: RunPersonaOverride | null;
+	/** Decision refs sealed on the request by the dispatch tool; null when the parent board was empty. */
+	decisionRefs: ReadonlyArray<string> | null;
 	projectContext: RunProjectContextProvenance;
 	/** ACP delegation bypasses the worker prompt compiler entirely, so this is always []. */
 	rulesApplied: string[];
@@ -1439,6 +1451,13 @@ function runtimeLimitations(runtimeKind: RunKind, runtimeId: string): string[] {
 			"Claude CLI subprocess executes Claude Code tools; Clio constrains permission mode and forbids dangerous bypass unless explicitly gated",
 		];
 	}
+	if (runtimeKind === "subprocess" && runtimeId === "antigravity-code") {
+		return [
+			"Antigravity CLI owns its internal tools, network activity, prompts, and approvals; Clio observes only structured stream output and does not provide per-tool mediation or complete tool telemetry",
+			"Antigravity conversation ids are recorded only as opaque provider observations; Clio does not resume them",
+			"Antigravity runs are one-shot and never retried automatically",
+		];
+	}
 	// HTTP/native runtimes run through pi-agent-core, which Clio observes and
 	// controls directly, so there are no runtime-imposed dispatch limitations.
 	return [];
@@ -1479,13 +1498,6 @@ function assertWriteRootsEnforceable(runtime: RuntimeDescriptor, writeRoots: Rea
 	);
 }
 
-function assertWorkerBudgetEnforceable(runtime: RuntimeDescriptor, hasDeclaredBudget: boolean): void {
-	if (!hasDeclaredBudget || runtime.kind !== "subprocess") return;
-	throw new Error(
-		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
-	);
-}
-
 /**
  * API families whose wire protocol carries tool calls. Membership is a property
  * of the protocol, not of any one model: every server speaking one of these can
@@ -1614,13 +1626,38 @@ function workerToolCallHardCap(settings: EffectiveSettings): number {
 	return settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap;
 }
 
+/**
+ * Only a runtime that declares its external agent loop may accept a declared
+ * per-tool budget: Clio records that budget as unobserved rather than enforced.
+ * Any other subprocess runtime cannot mediate tool calls, so a declared budget
+ * would be a claim nobody enforces.
+ */
+export function assertWorkerBudgetEnforceable(
+	runtime: Pick<RuntimeDescriptor, "id" | "kind" | "externalAgentLoop">,
+	hasDeclaredBudget: boolean,
+): void {
+	if (!hasDeclaredBudget || runtime.kind !== "subprocess" || runtime.externalAgentLoop !== undefined) return;
+	throw new Error(
+		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
+	);
+}
+
+/** Per-tool budget enforcement is real only where Clio observes each tool call. */
+export function budgetEnforcementForRuntime(
+	runtime: Pick<RuntimeDescriptor, "kind">,
+): "native-per-tool" | "external-one-shot" {
+	return runtime.kind === "subprocess" ? "external-one-shot" : "native-per-tool";
+}
+
 function resolveEffectiveWorkerBudget(input: {
 	req: DispatchRequest;
 	recipeId: string;
 	declared: ReturnType<typeof normalizeAgentSpec>["budget"];
 	allowedTools: ReadonlyArray<ToolName>;
 	settings: EffectiveSettings;
+	runtime: RuntimeDescriptor;
 }): RunToolBudgetEnvelope {
+	assertWorkerBudgetEnforceable(input.runtime, input.declared !== null || input.req.budget !== undefined);
 	const hardCap = workerToolCallHardCap(input.settings);
 	const declared = input.declared ?? {
 		toolCalls: hardCap,
@@ -1635,6 +1672,7 @@ function resolveEffectiveWorkerBudget(input: {
 		hasReadTool: input.allowedTools.includes(ToolNames.Read),
 		retry: (input.req.lineage?.attempt ?? 0) > 0,
 		revision: input.req.gate?.role === "builder" && input.req.gate.cycle > 1 && input.req.gate.verdict === "revise",
+		enforcement: budgetEnforcementForRuntime(input.runtime),
 	});
 }
 
@@ -1925,7 +1963,7 @@ function buildDispatchWorkerSpec(input: DispatchWorkerSpecInput, config?: Config
 	if (
 		input.req.noSkills !== true &&
 		recipeSkills.length > 0 &&
-		input.admission.allowedTools.includes(ToolNames.Context)
+		canonicalContextAttached(input.target.runtime, input.admission.allowedTools)
 	) {
 		spec.agentSkills = [...new Set(recipeSkills)];
 	}
@@ -1975,6 +2013,15 @@ function clampWorkerAutonomy(session: AutonomyLevel, requested: AutonomyLevel |
 	return AUTONOMY_ORDER[requested] < AUTONOMY_ORDER[session] ? requested : session;
 }
 
+/** Read-only recipes are an authority boundary, including on opaque external loops. */
+export function effectiveWorkerAutonomy(
+	session: AutonomyLevel,
+	requested: AutonomyLevel | undefined,
+	capabilityClass: AgentCapabilityClass,
+): AutonomyLevel {
+	return clampWorkerAutonomy(session, capabilityClass === "read-only" ? "read-only" : requested);
+}
+
 function requestedAutonomyEvidence(
 	sessionAutonomy: AutonomyLevel,
 	requestedAutonomy: AutonomyLevel | undefined,
@@ -2662,6 +2709,7 @@ export function createDispatchBundle(
 		nodeId: string,
 		timing: RunPhaseMarks,
 		endpoint?: EndpointCapacity | null,
+		signal?: AbortSignal,
 	) {
 		const queuedAt = now();
 		timing.queuedAt = new Date(queuedAt).toISOString();
@@ -2677,7 +2725,12 @@ export function createDispatchBundle(
 				: planQueueSlot(req.reservation.ownerId, req.reservation.memberId, (error) =>
 						reportDispatchDiagnostic("read plan queue identity", error),
 					);
+		const cancel = (): void => {
+			capacityAdmission.cancel(assignmentId);
+		};
+		signal?.addEventListener("abort", cancel, { once: true });
 		try {
+			signal?.throwIfAborted();
 			const admitted = await capacityAdmission.admit({
 				assignmentId,
 				nodeId,
@@ -2700,17 +2753,19 @@ export function createDispatchBundle(
 				else await failQueuedAssignment(assignmentId);
 			}
 			throw error;
+		} finally {
+			signal?.removeEventListener("abort", cancel);
 		}
 	}
 
 	/** Retries only: the first attempt's member was consumed with the planned bound. */
-	function rebindReservationSlot(
+	async function rebindReservationSlot(
 		req: DispatchRequest,
 		nodeId: string,
 		endpoint: EndpointCapacity | null,
 		costUsd: number,
 		settings: EffectiveSettings,
-	): void {
+	): Promise<void> {
 		if (req.reservation === undefined || req.lineage === undefined) return;
 		const capacity = reservationCapacitySnapshot(settings);
 		const rebind = {
@@ -2721,7 +2776,7 @@ export function createDispatchBundle(
 			capacity,
 			nowMs: now(),
 		};
-		rebindDispatchReservationMember(rebind);
+		await rebindDispatchReservationMember(rebind);
 	}
 
 	/** Process-local retry queue keyed by finished run; backoff is keyed by assignment root. */
@@ -2849,6 +2904,14 @@ export function createDispatchBundle(
 		if (draining) return { scheduled: false };
 		const rootRunId = run.lineage.rootRunId;
 		if (!retryChainIsLive(run)) return { scheduled: false };
+		if (providers.getRuntime(run.runtimeId)?.externalAgentLoop?.generatingRetry === "forbidden") {
+			retryBackoff.delete(rootRunId);
+			return {
+				scheduled: false,
+				settlementDetail:
+					"automatic retry suppressed because this external agent loop is one-shot and Clio cannot prove replay is side-effect-free",
+			};
+		}
 		if (!RETRYABLE_OUTCOMES.has(outcome)) {
 			retryBackoff.delete(rootRunId);
 			return { scheduled: false };
@@ -3224,6 +3287,9 @@ export function createDispatchBundle(
 		const tickMonotonic = monotonicNow();
 		for (const run of active.values()) {
 			if (run.aborted || run.stallKilled || !run.heartbeatAt) continue;
+			// Finalizers retain active entries while awaiting ledger persistence.
+			// Their terminal status is already sealed into the receipt digest.
+			if (ledger.get(run.runId)?.endedAt !== null) continue;
 			const heartbeatMonotonic = heartbeatMonotonicAt(run.heartbeatAt);
 			if (!Number.isFinite(heartbeatMonotonic) || !Number.isFinite(run.heartbeatAt.current)) continue;
 			if (run.runtimeKind === "acp-delegation") {
@@ -3415,7 +3481,12 @@ export function createDispatchBundle(
 		}
 	}
 
-	async function resolveLifecycle(req: DispatchRequest, settings: EffectiveSettings): Promise<DispatchLifecycleStage> {
+	async function resolveLifecycle(
+		req: DispatchRequest,
+		settings: EffectiveSettings,
+		metadataDeadlineAt: number,
+		signal?: AbortSignal,
+	): Promise<DispatchLifecycleStage> {
 		const recipe = agents.get(req.agentId);
 		if (!recipe) {
 			throw new Error(`dispatch: unknown agent recipe: ${req.agentId}`);
@@ -3453,22 +3524,35 @@ export function createDispatchBundle(
 		publishDispatchPathScope(req, pathScope);
 		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
-		const target = resolveDispatchTarget(
-			req,
-			recipe,
-			targets.workerDefault,
-			targets.workerProfiles,
-			targets.agentBindings,
-			targets.targetOrder,
-			providers,
-		);
+		const resolveTarget = () =>
+			resolveDispatchTarget(
+				req,
+				recipe,
+				targets.workerDefault,
+				targets.workerProfiles,
+				targets.agentBindings,
+				targets.targetOrder,
+				providers,
+			);
+		let target = resolveTarget();
+		const identity = (resolved: ResolvedTarget): string =>
+			JSON.stringify([
+				resolved.target.id,
+				resolved.runtime.id,
+				resolved.wireModelId,
+				endpointIdentityHash(resolved.target.url),
+			]);
+		const selectedIdentity = identity(target);
+		await prepareWorkerModelMetadata(providers, target.target.id, metadataDeadlineAt, signal, now);
+		target = resolveTarget();
+		if (identity(target) !== selectedIdentity) {
+			throw new Error("dispatch: worker route changed during model metadata preparation; request a fresh admission");
+		}
 		enforceCapabilityGate(target.target.id, target.modelCapabilities, req.requiredCapabilities);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.fleet.permissions.mode ?? "deny");
-		assertWorkerBudgetEnforceable(target.runtime, spec.budget !== null || req.budget !== undefined);
-
 		const cwd = req.cwd ?? process.cwd();
 		const sessionAutonomy = settings?.safety.autonomy ?? "auto-edit";
-		const effectiveAutonomy = clampWorkerAutonomy(sessionAutonomy, req.autonomy);
+		const effectiveAutonomy = effectiveWorkerAutonomy(sessionAutonomy, req.autonomy, spec.capabilityClass);
 		const effectiveTools = withLedgerToolNarrowing(
 			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
@@ -3478,8 +3562,8 @@ export function createDispatchBundle(
 			...admission,
 			allowedTools: effectiveTools,
 		};
-		const personaBody = workerPersonaBody(req, recipe, effectiveTools);
-		const hasCanonicalContext = effectiveTools.includes(ToolNames.Context);
+		const hasCanonicalContext = canonicalContextAttached(target.runtime, effectiveTools);
+		const personaBody = workerPersonaBody(req, recipe, hasCanonicalContext);
 		const hasBoundSkills =
 			hasCanonicalContext && recipe.skills !== undefined && recipe.skills.length > 0 && req.noSkills !== true;
 		const compiledWorkerPrompt = await prompts.compileWorkerPrompt({
@@ -3507,6 +3591,7 @@ export function createDispatchBundle(
 			declared: spec.budget,
 			allowedTools: effectiveTools,
 			settings,
+			runtime: target.runtime,
 		});
 		// Fetch structured project context only for tiers that receive it, so
 		// read-only scouts never pay the CLIO-CODER.md read. The tier is spec policy
@@ -3563,6 +3648,7 @@ export function createDispatchBundle(
 			pipeline: pipelineProvenanceFor(req),
 			briefing: briefingProvenanceFor(req),
 			personaOverride,
+			decisionRefs: req.decisionRefs ?? null,
 			projectContext: projectContextProvenance,
 			rulesApplied: compiledWorkerPrompt.rulesApplied ?? [],
 			operatorProfileApplied: compiledWorkerPrompt.operatorProfileApplied ?? false,
@@ -3610,7 +3696,7 @@ export function createDispatchBundle(
 		}
 		const cwd = req.cwd ?? process.cwd();
 		const pathScope = resolveDispatchPathScope(req);
-		const personaBody = workerPersonaBody(req, null, []);
+		const personaBody = workerPersonaBody(req, null, false);
 		// ACP owns an unknown external tool inventory, so it receives the raw
 		// bounded persona rather than a native Clio schema-harness claim.
 		const systemPrompt = personaBody;
@@ -3652,6 +3738,7 @@ export function createDispatchBundle(
 			pipeline: pipelineProvenanceFor(req),
 			briefing: briefingProvenanceFor(req),
 			personaOverride,
+			decisionRefs: req.decisionRefs ?? null,
 			projectContext: projectContextProvenance,
 			rulesApplied: [],
 			operatorProfileApplied: false,
@@ -3827,11 +3914,13 @@ export function createDispatchBundle(
 				const responseModelIdObservation = responseModelIdObservationFromRecord(event.message, "not-observed");
 				const differingResponseModelId = readStringOrNull(event.message.responseModel);
 				const providerResponseId = readStringOrNull(event.message.responseId);
+				const gatewayRouting = gatewayRoutingObservationFromRecord(event.message);
 				upstreamResponses.push({
 					requestedModelId,
 					responseModelIdObservation,
 					differingResponseModelId,
 					providerResponseId,
+					...(gatewayRouting !== null ? { gatewayRouting } : {}),
 				});
 				if (event.message.stopReason === "error") {
 					const message = readStringOrNull(event.message.errorMessage);
@@ -3931,6 +4020,7 @@ export function createDispatchBundle(
 				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
+				...(lifecycle.decisionRefs ? { decisionRefs: lifecycle.decisionRefs } : {}),
 			});
 			observer?.onAdmitted({
 				runId: envelope.id,
@@ -4003,6 +4093,12 @@ export function createDispatchBundle(
 		});
 
 		const startedAt = envelope.startedAt;
+		let resolveFinal!: (receipt: RunReceipt) => void;
+		let rejectFinal!: (error: unknown) => void;
+		const finalPromise = new Promise<RunReceipt>((res, rej) => {
+			resolveFinal = res;
+			rejectFinal = rej;
+		});
 		const activeRun: ActiveRun = {
 			runId: envelope.id,
 			req,
@@ -4034,7 +4130,7 @@ export function createDispatchBundle(
 			meter: tokenMeter,
 			pricing: null,
 			costProvenance: "unknown",
-			finalPromise: undefined as unknown as Promise<RunReceipt>,
+			finalPromise,
 		};
 
 		const buildReceiptDraft = (
@@ -4092,6 +4188,7 @@ export function createDispatchBundle(
 				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
+				...(lifecycle.decisionRefs ? { decisionRefs: lifecycle.decisionRefs } : {}),
 				projectContext: lifecycle.projectContext,
 				rulesApplied: lifecycle.rulesApplied,
 				operatorProfileApplied: lifecycle.operatorProfileApplied,
@@ -4217,7 +4314,6 @@ export function createDispatchBundle(
 		const assessDispatchFinishContract = (): DispatchFinishContractSnapshot | null => {
 			if (finishContractAssistantText.trim().length === 0) return null;
 			const assessment = assessFinishContract({
-				assistantText: finishContractAssistantText,
 				sessionEntries: finishContractEntries,
 				assistantTurnId: finishContractAssistantTurnId,
 			});
@@ -4238,7 +4334,7 @@ export function createDispatchBundle(
 			return { assessment, rigor };
 		};
 
-		const finalPromise = (async (): Promise<RunReceipt> => {
+		(async (): Promise<RunReceipt> => {
 			try {
 				const result = await acp.promise;
 				// The receipt reads meters the domain pump fills. Finalization
@@ -4374,9 +4470,7 @@ export function createDispatchBundle(
 			} finally {
 				leaseSlot.release();
 			}
-		})();
-
-		activeRun.finalPromise = finalPromise;
+		})().then(resolveFinal, rejectFinal);
 		active.set(envelope.id, activeRun);
 
 		return {
@@ -4389,6 +4483,7 @@ export function createDispatchBundle(
 	async function dispatchAttempt(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
 		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
@@ -4483,7 +4578,7 @@ export function createDispatchBundle(
 					"dispatch: writeRoots cannot be enforced on an ACP delegation target; the external agent runs its own tool surface. Dispatch to a native or claude-sdk worker.",
 				);
 			}
-			rebindReservationSlot(req, "local", null, UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
+			await rebindReservationSlot(req, "local", null, UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
 			routeObservation = observeShadowRoute(req, undefined, settings);
 			const delegated = await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer);
 			// An ACP member never runs host verification, so it can only ever leave
@@ -4494,7 +4589,10 @@ export function createDispatchBundle(
 		}
 
 		req = routeAroundCoolingTarget(req, settings) ?? req;
-		const lifecycle = await resolveLifecycle(req, settings);
+		const metadataDeadlineAt =
+			req.assignmentDeadlineAt ?? Date.parse(requestedAt) + (req.routingIntent?.deadlineMs ?? 60_000);
+		const lifecycle = await resolveLifecycle(req, settings, metadataDeadlineAt, preparation?.signal);
+		preparation?.signal?.throwIfAborted();
 		timing.decisionCompletedAt = new Date(now()).toISOString();
 		assertResponseSchemaEnforceable(
 			lifecycle.target.runtime,
@@ -4521,7 +4619,7 @@ export function createDispatchBundle(
 		};
 		const endpoint = endpointCapacityForTarget(lifecycle.target.target.id);
 		assertRouteWithinApprovedEnvelope(req, effectiveRoute);
-		rebindReservationSlot(
+		await rebindReservationSlot(
 			req,
 			effectiveRoute.node,
 			endpoint,
@@ -4571,7 +4669,13 @@ export function createDispatchBundle(
 		if (queuedIdentity !== null) publishCapacityQueued(queuedIdentity, timing, placement?.node ?? null);
 		let capacityLease: Awaited<ReturnType<typeof admitAssignmentCapacity>>;
 		try {
-			capacityLease = await admitAssignmentCapacity(req, placement?.node.id ?? "local", timing, endpoint);
+			capacityLease = await admitAssignmentCapacity(
+				req,
+				placement?.node.id ?? "local",
+				timing,
+				endpoint,
+				preparation?.signal,
+			);
 		} catch (error) {
 			if (queuedIdentity !== null) publishCapacityAdmissionFailure(queuedIdentity, error);
 			throw error;
@@ -4582,6 +4686,7 @@ export function createDispatchBundle(
 
 		const ledgerRef = (() => {
 			try {
+				preparation?.signal?.throwIfAborted();
 				return requireLedger();
 			} catch (error) {
 				leaseSlot.release();
@@ -4644,6 +4749,7 @@ export function createDispatchBundle(
 		};
 		let worker: SpawnedWorker;
 		try {
+			preparation?.signal?.throwIfAborted();
 			worker = (placement?.spawn ?? spawnWorker)(spec, {
 				cwd: lifecycle.cwd,
 				now,
@@ -4865,11 +4971,13 @@ export function createDispatchBundle(
 				const responseModelIdObservation = responseModelIdObservationFromRecord(event.message, "not-observed");
 				const differingResponseModelId = readStringOrNull(event.message.responseModel);
 				const providerResponseId = readStringOrNull(event.message.responseId);
+				const gatewayRouting = gatewayRoutingObservationFromRecord(event.message);
 				upstreamResponses.push({
 					requestedModelId,
 					responseModelIdObservation,
 					differingResponseModelId,
 					providerResponseId,
+					...(gatewayRouting !== null ? { gatewayRouting } : {}),
 				});
 				if (event.message.stopReason === "error") {
 					const message = readStringOrNull(event.message.errorMessage);
@@ -5018,6 +5126,7 @@ export function createDispatchBundle(
 				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
+				...(lifecycle.decisionRefs ? { decisionRefs: lifecycle.decisionRefs } : {}),
 				...(heartbeatAt ? { heartbeatAt: heartbeatIso(heartbeatAt) } : {}),
 			});
 			observer?.onAdmitted({
@@ -5121,6 +5230,13 @@ export function createDispatchBundle(
 
 		const startedAt = envelope.startedAt;
 
+		let resolveFinal!: (receipt: RunReceipt) => void;
+		let rejectFinal!: (error: unknown) => void;
+		const finalPromise = new Promise<RunReceipt>((res, rej) => {
+			resolveFinal = res;
+			rejectFinal = rej;
+		});
+
 		const activeRun: ActiveRun = {
 			runId: envelope.id,
 			req,
@@ -5156,7 +5272,7 @@ export function createDispatchBundle(
 			meter: tokenMeter,
 			pricing: lifecycle.target.effectivePricing.rates,
 			costProvenance: lifecycle.target.effectivePricing.provenance,
-			finalPromise: undefined as unknown as Promise<RunReceipt>,
+			finalPromise,
 		};
 
 		const buildReceiptDraft = (
@@ -5251,6 +5367,7 @@ export function createDispatchBundle(
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(fleetGate !== null ? { fleetGate } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
+				...(lifecycle.decisionRefs ? { decisionRefs: lifecycle.decisionRefs } : {}),
 				projectContext: lifecycle.projectContext,
 				rulesApplied: lifecycle.rulesApplied,
 				operatorProfileApplied: lifecycle.operatorProfileApplied,
@@ -5394,7 +5511,6 @@ export function createDispatchBundle(
 		const assessDispatchFinishContract = (): DispatchFinishContractSnapshot | null => {
 			if (finishContractAssistantText.trim().length === 0) return null;
 			const assessment = assessFinishContract({
-				assistantText: finishContractAssistantText,
 				sessionEntries: finishContractEntries,
 				assistantTurnId: finishContractAssistantTurnId,
 			});
@@ -5423,7 +5539,7 @@ export function createDispatchBundle(
 		// finalPromise settles.
 		settlement?.live(envelope.id);
 
-		const finalPromise = (async (): Promise<RunReceipt> => {
+		(async (): Promise<RunReceipt> => {
 			try {
 				const result = await workerDone;
 				// The receipt reads meters the domain pump fills. Finalization
@@ -5493,7 +5609,9 @@ export function createDispatchBundle(
 					reachedTerminalResult: resultContractWasDue(finalOutcome, outcomeCode),
 					output: capturedOutput?.state === "final" ? capturedOutput.text : null,
 					cwd: lifecycle.cwd,
-					networkAllowed: lifecycle.admission.allowedTools.includes(ToolNames.WebFetch),
+					networkAllowed:
+						lifecycle.admission.allowedTools.includes(ToolNames.WebFetch) ||
+						lifecycle.target.runtime.externalAgentLoop?.network === "externally-governed-unobserved",
 					observedRunEffects,
 					filesystem: nodeResultContractFilesystem(),
 				});
@@ -5738,9 +5856,8 @@ export function createDispatchBundle(
 				unsubscribeAgentLedger?.();
 				leaseSlot.release();
 			}
-		})();
+		})().then(resolveFinal, rejectFinal);
 
-		activeRun.finalPromise = finalPromise;
 		active.set(envelope.id, activeRun);
 
 		return attachRouteObservation({
@@ -5754,13 +5871,20 @@ export function createDispatchBundle(
 	async function dispatch(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
 		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
 		finalPromise: Promise<RunReceipt>;
 	}> {
-		let prepared = req;
+		let prepared =
+			preparation?.deadlineAt === undefined
+				? req
+				: {
+						...req,
+						assignmentDeadlineAt: Math.min(req.assignmentDeadlineAt ?? Number.POSITIVE_INFINITY, preparation.deadlineAt),
+					};
 		let createdWorktree: DispatchRequest["taskWorktree"];
 		let writerLease: CheckoutWriterLease | undefined;
 		const writerRecipe = agents.get(req.agentId);
@@ -5792,7 +5916,7 @@ export function createDispatchBundle(
 				return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? entry : resolvePath(taskWorktree.path, rel);
 			});
 			prepared = {
-				...req,
+				...prepared,
 				runIdHint: runId,
 				taskWorktree,
 				cwd: workerCwd,
@@ -5802,7 +5926,8 @@ export function createDispatchBundle(
 		}
 		let handle: Awaited<ReturnType<typeof dispatchAttempt>>;
 		try {
-			handle = await dispatchAttempt(prepared, observer, settlement);
+			preparation?.signal?.throwIfAborted();
+			handle = await dispatchAttempt(prepared, observer, preparation, settlement);
 		} catch (error) {
 			writerLease?.release();
 			if (createdWorktree !== undefined) {
@@ -5929,7 +6054,6 @@ export function createDispatchBundle(
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, agentSpec, effectiveTools, target);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.fleet.permissions.mode ?? "deny");
-		assertWorkerBudgetEnforceable(target.runtime, agentSpec.budget !== null || req.budget !== undefined);
 		assertResponseSchemaEnforceable(target.runtime, target.modelCapabilities, req.responseSchema, effectiveTools.length);
 		assertWriteRootsEnforceable(target.runtime, pathScope.writeBoundaries);
 		assertProtectedArtifactsEnforceable(
@@ -5943,6 +6067,7 @@ export function createDispatchBundle(
 			declared: agentSpec.budget,
 			allowedTools: effectiveTools,
 			settings,
+			runtime: target.runtime,
 		});
 		const endpoint = endpointCapacityForTarget(target.target.id);
 		return {
@@ -6191,7 +6316,10 @@ export function createDispatchBundle(
 		})();
 	}
 
-	async function dispatchBatch(reqs: ReadonlyArray<DispatchRequest>): Promise<{
+	async function dispatchBatch(
+		reqs: ReadonlyArray<DispatchRequest>,
+		preparation?: DispatchPreparationOptions,
+	): Promise<{
 		batchId: string;
 		assignmentIds: ReadonlyArray<string>;
 		events: AsyncIterableIterator<unknown>;
@@ -6210,7 +6338,7 @@ export function createDispatchBundle(
 		const handles: Array<Awaited<ReturnType<typeof dispatch>> & { agentId: string }> = [];
 		try {
 			for (const req of reqs) {
-				const handle = await dispatch(req, undefined, settlement);
+				const handle = await dispatch(req, undefined, preparation, settlement);
 				handles.push({ ...handle, agentId: req.agentId });
 			}
 		} catch (err) {

package/src/domains/dispatch/fleet-commit-attribution.ts

@@ -6,6 +6,8 @@ export interface FleetCommitPriorResult {
 	succeeded: boolean;
 	integrityValid: boolean;
 	receiptDigest: string;
+	/** Decision refs from the step's sealed receipt; they become `Clio-Decision:` trailers. */
+	decisionRefs?: ReadonlyArray<string>;
 }
 
 /**
@@ -23,6 +25,7 @@ export function deriveFleetCommitAttribution(input: {
 	const byId = new Map(input.plan.steps.map((step) => [step.id, step] as const));
 	let materiallyAuthored = false;
 	let receipt: CommitAttributionEvidence["receipt"];
+	let decisions: CommitAttributionEvidence["decisions"];
 	for (const candidate of input.step.commitFrom ?? []) {
 		const source = byId.get(candidate);
 		const result = input.priorResults.get(candidate);
@@ -35,6 +38,7 @@ export function deriveFleetCommitAttribution(input: {
 			continue;
 		}
 		materiallyAuthored = true;
+		if (result.decisionRefs !== undefined && result.decisionRefs.length > 0) decisions = [...result.decisionRefs];
 		if (/^[0-9a-f]{64}$/u.test(result.receiptDigest)) {
 			receipt = {
 				version: RUN_RECEIPT_INTEGRITY_VERSION,
@@ -52,5 +56,6 @@ export function deriveFleetCommitAttribution(input: {
 		validationSucceeded: input.validationFresh,
 		independentReviewPassed: input.independentReviewFresh,
 		...(receipt === undefined ? {} : { receipt }),
+		...(decisions === undefined ? {} : { decisions }),
 	};
 }