@iowarp/clio-coder 0.4.9 → 0.5.0

package/src/domains/dispatch/failure-classification.ts

@@ -1,4 +1,5 @@
 import { isResponseSchemaRejection } from "../../core/response-schema.js";
+import { isEngineContextOverflow } from "../../engine/ai.js";
 import { WORKER_EXIT_PERMISSION_REQUIRED } from "../../worker/spec-contract.js";
 import { isDeterministicOutcomeCode } from "./backoff.js";
 import type { RunTerminationEvidence } from "./outcome.js";
@@ -31,10 +32,37 @@ export interface RetryDecision {
 	reasonCode: string;
 }
 
+/**
+ * Target failures worth another attempt. A bare 500 and a refused, reset, or
+ * failed connection mean the endpoint could not answer this time, not that the
+ * worker runtime is broken, so they fail over to another target.
+ */
+const TRANSIENT_TARGET_TEXT =
+	/timeout|temporar|unavailable|\b50[0234]\b|internal server error|econnrefused|econnreset|fetch failed/;
+
+const WORKERSPEC_REJECTION = /\[worker\] fatal: workerspec/;
+
 function resultText(result: SpawnedWorkerResult | null): string {
 	return result?.stderrTail?.toLowerCase() ?? "";
 }
 
+/**
+ * Whether a deterministic-task class came from the provider's context-overflow
+ * verdict rather than an outcome code, a rejected schema, or a rejected worker
+ * spec. Only this cause can succeed elsewhere: the same prompt fits a route
+ * whose window is larger.
+ */
+export function isContextOverflowFailure(
+	failureClass: FailureClass,
+	result: SpawnedWorkerResult | null,
+	code: RunOutcomeCode | null | undefined,
+): boolean {
+	if (failureClass !== "deterministic-task" || isDeterministicOutcomeCode(code)) return false;
+	const diagnostic = resultText(result);
+	if (diagnostic === "" || isResponseSchemaRejection(diagnostic) || WORKERSPEC_REJECTION.test(diagnostic)) return false;
+	return isEngineContextOverflow(diagnostic);
+}
+
 /** Classify coordinator-owned termination evidence without mutating routing state. */
 export function classifyFailure(
 	evidence: RunTerminationEvidence,
@@ -66,12 +94,19 @@ export function classifyFailure(
 	// rejection, so three attempts only tripled the cost of one configuration
 	// error. Ending it here surfaces the contract message the operator has to act
 	// on instead of burying it under two more identical failures.
-	if (/\[worker\] fatal: workerspec/.test(diagnostic)) return "deterministic-task";
+	if (WORKERSPEC_REJECTION.test(diagnostic)) return "deterministic-task";
+	// A provider that reports the prompt no longer fits the model's context
+	// window has judged the request, not the target. The identical input earns
+	// the identical overflow on every retry, and charging it to the target
+	// breaker would park a healthy endpoint for runs whose prompts do fit. The
+	// engine's detector carries pi-ai's per-provider patterns, including the
+	// llama.cpp and Ollama "exceeds the available context size" wording.
+	if (diagnostic !== "" && isEngineContextOverflow(diagnostic)) return "deterministic-task";
 	if (/\b(?:401|403)\b|unauthorized|forbidden|invalid api key|authentication/.test(diagnostic)) return "target-auth";
 	if (/\b429\b|rate[ -]?limit|too many requests/.test(diagnostic)) return "target-rate-limit";
 	if (/\bvram\b|\bgpu\b|\bcuda\b|\boom\b|out of memory/.test(diagnostic)) return "node-resource";
 	if (/capacity|overloaded|queue full/.test(diagnostic)) return "capacity";
-	if (evidence.timedOut || outcome === "timed_out" || /timeout|temporar|unavailable|\b50[234]\b/.test(diagnostic)) {
+	if (evidence.timedOut || outcome === "timed_out" || TRANSIENT_TARGET_TEXT.test(diagnostic)) {
 		return "target-transient";
 	}
 	if (outcome === "failed") return "worker-runtime";

package/src/domains/dispatch/receipt-integrity.ts

@@ -142,6 +142,9 @@ export const RECEIPT_INTEGRITY_FIELD_COVERAGE = {
 	skillActivations: true,
 	autonomyEnforcement: true,
 	safety: true,
+	// Optional and absent on worker receipts and on older main-agent receipts,
+	// so those digest exactly as they did before the field existed.
+	noop: true,
 	reproducibility: true,
 	runtimeResolution: true,
 	delegation: true,

package/src/domains/dispatch/run-identity.ts

@@ -16,11 +16,18 @@ function nonEmpty(value: string | undefined): string | null {
 export function detectRunIdentity(env: NodeJS.ProcessEnv = process.env): RunIdentity {
 	let user = "unknown";
 	try {
-		user = userInfo().username;
+		user =
+			nonEmpty(userInfo().username) ?? nonEmpty(env.USER) ?? nonEmpty(env.LOGNAME) ?? nonEmpty(env.USERNAME) ?? "unknown";
 	} catch {
-		user = nonEmpty(env.USER) ?? nonEmpty(env.LOGNAME) ?? "unknown";
+		user = nonEmpty(env.USER) ?? nonEmpty(env.LOGNAME) ?? nonEmpty(env.USERNAME) ?? "unknown";
 	}
-	const identity: RunIdentity = { host: hostname(), user, hpc: null };
+	let host = "unknown";
+	try {
+		host = hostname() || "unknown";
+	} catch {
+		// Restricted environments may not expose a host identity.
+	}
+	const identity: RunIdentity = { host, user, hpc: null };
 
 	const slurmJobId = nonEmpty(env.SLURM_JOB_ID);
 	if (slurmJobId !== null) {

package/src/domains/dispatch/target-breaker.ts

@@ -0,0 +1,163 @@
+/**
+ * Per-route circuit breaker for dispatch targets.
+ *
+ * A route is one (target, runtime, wire model) key. It starts closed. Each
+ * breaker-affecting failure adds to a consecutive-failure count, and the count
+ * reaching the threshold opens the route for the base cooldown. When the
+ * cooldown expires the route is half-open: the next dispatch that asks to run
+ * on it is admitted as the probe, and every other dispatch still sees the route
+ * as cooling until the probe reports. A probe success closes the route and
+ * resets both the count and the backoff. A probe failure reopens it with the
+ * cooldown doubled, capped at the larger of MAX_TARGET_BREAKER_COOLDOWN_MS and
+ * the base cooldown.
+ *
+ * The state is process-local and in memory, so it is timed on the injected
+ * monotonic clock rather than the wall clock.
+ */
+
+/** Ceiling for the doubled probe-failure cooldown: five minutes. */
+export const MAX_TARGET_BREAKER_COOLDOWN_MS = 300_000;
+
+export type TargetBreakerBlock =
+	| { kind: "open"; remainingMs: number; reason: string }
+	| { kind: "probing"; reason: string };
+
+export type TargetBreakerOutcome = "success" | "failure" | "neutral";
+
+/**
+ * One route's breaker state for operator surfaces. "half-open" means the
+ * cooldown expired and the next dispatch will be admitted as the probe;
+ * "probing" means that probe is in flight. A closed route appears only while
+ * it carries consecutive failures below the threshold. remainingMs is read
+ * from the injected monotonic clock and is only meaningful in this process.
+ */
+export interface TargetBreakerRouteSnapshot {
+	key: string;
+	state: "open" | "half-open" | "probing" | "closed";
+	remainingMs: number;
+	reason: string;
+	consecutiveFailures: number;
+}
+
+export interface TargetBreakerOptions {
+	monotonicNow: () => number;
+	/** Base cooldown in ms; zero or less disables tripping. */
+	cooldownMs: () => number;
+	/** Consecutive breaker-affecting failures that open a closed route. */
+	threshold: () => number;
+	maxCooldownMs?: number;
+}
+
+export interface TargetBreaker {
+	/** Read-only view: why a dispatch could not use the route now, or null. */
+	blocked(key: string): TargetBreakerBlock | null;
+	/** Admission: like blocked(), but a half-open route is claimed as owner's probe. */
+	admit(key: string, owner: string): TargetBreakerBlock | null;
+	/** Give back a probe claim whose dispatch never started. */
+	release(key: string, owner: string): void;
+	/** Fold one run's outcome into the route. owner is the finished run's id. */
+	record(key: string, owner: string, outcome: TargetBreakerOutcome, reason: string): void;
+	/** Read-only view of every route that is not closed and clean. Never claims a probe. */
+	snapshot(): TargetBreakerRouteSnapshot[];
+}
+
+interface RouteState {
+	failures: number;
+	/** Failure class of the latest breaker-affecting failure. */
+	lastReason: string;
+	/** Present once the route has tripped; absent while closed. */
+	open: { until: number; cooldownMs: number; reason: string; probeOwner: string | null } | null;
+}
+
+export function createTargetBreaker(options: TargetBreakerOptions): TargetBreaker {
+	const routes = new Map<string, RouteState>();
+	const maxCooldownMs = options.maxCooldownMs ?? MAX_TARGET_BREAKER_COOLDOWN_MS;
+
+	function blockOf(state: RouteState | undefined, owner: string | null): TargetBreakerBlock | null {
+		const open = state?.open;
+		if (!open) return null;
+		const remainingMs = open.until - options.monotonicNow();
+		if (remainingMs > 0) return { kind: "open", remainingMs, reason: open.reason };
+		if (open.probeOwner === null) {
+			if (owner !== null) open.probeOwner = owner;
+			return null;
+		}
+		if (open.probeOwner === owner) return null;
+		return { kind: "probing", reason: open.reason };
+	}
+
+	return {
+		blocked: (key) => blockOf(routes.get(key), null),
+		admit: (key, owner) => blockOf(routes.get(key), owner),
+		snapshot() {
+			const now = options.monotonicNow();
+			const rows: TargetBreakerRouteSnapshot[] = [];
+			for (const [key, state] of routes) {
+				const open = state.open;
+				if (open === null) {
+					if (state.failures > 0) {
+						rows.push({
+							key,
+							state: "closed",
+							remainingMs: 0,
+							reason: state.lastReason,
+							consecutiveFailures: state.failures,
+						});
+					}
+					continue;
+				}
+				const remainingMs = Math.max(0, open.until - now);
+				const phase = remainingMs > 0 ? "open" : open.probeOwner === null ? "half-open" : "probing";
+				rows.push({ key, state: phase, remainingMs, reason: open.reason, consecutiveFailures: state.failures });
+			}
+			return rows;
+		},
+		release(key, owner) {
+			const open = routes.get(key)?.open;
+			if (open && open.probeOwner === owner) open.probeOwner = null;
+		},
+		record(key, owner, outcome, reason) {
+			const state = routes.get(key);
+			if (outcome === "success") {
+				routes.delete(key);
+				return;
+			}
+			const probe = state?.open?.probeOwner === owner ? state.open : null;
+			if (outcome === "neutral") {
+				// A failure that says nothing about the target proves neither health
+				// nor sickness. A probe that ended this way frees the slot so the next
+				// dispatch can probe instead of the route waiting forever.
+				if (probe) probe.probeOwner = null;
+				return;
+			}
+			const baseMs = options.cooldownMs();
+			if (baseMs <= 0) return;
+			const now = options.monotonicNow();
+			// Only the closed path reads the count; an open route keeps counting so
+			// the snapshot reports the whole failure streak.
+			if (state?.open) state.failures += 1;
+			if (probe) {
+				probe.cooldownMs = Math.min(probe.cooldownMs * 2, Math.max(maxCooldownMs, baseMs));
+				probe.until = now + probe.cooldownMs;
+				probe.reason = reason;
+				probe.probeOwner = null;
+				return;
+			}
+			if (state?.open) {
+				// A run admitted before the route tripped failed late. It re-arms the
+				// window at the current backoff without doubling it and leaves any
+				// probe in flight to decide the route.
+				state.open.until = Math.max(state.open.until, now + state.open.cooldownMs);
+				state.open.reason = reason;
+				return;
+			}
+			const next: RouteState = state ?? { failures: 0, lastReason: reason, open: null };
+			next.failures += 1;
+			next.lastReason = reason;
+			if (next.failures >= Math.max(1, options.threshold())) {
+				next.open = { until: now + baseMs, cooldownMs: baseMs, reason, probeOwner: null };
+			}
+			routes.set(key, next);
+		},
+	};
+}

package/src/domains/dispatch/types.ts

@@ -616,7 +616,20 @@ export interface RunReceiptSafetySummary {
 		escalationTimedOut?: number;
 	};
 	blockedAttempts: SafetyBlockedAttempt[];
-	requestedActions: ReadonlyArray<string>;
+	/**
+	 * Blocked attempts left out of `blockedAttempts` by the main agent's receipt
+	 * bound (50 entries, each reason clipped to 500 characters; see
+	 * `BLOCKED_ATTEMPTS_LIMIT` in cli/modes/print.ts). Present only when the
+	 * bound dropped an entry, so a receipt under it keeps its exact shape.
+	 * Worker receipts never set it.
+	 */
+	blockedAttemptsTruncated?: number;
+	/**
+	 * Action classes the dispatch admission granted. Worker receipts always
+	 * carry it; the main agent passes no dispatch admission, so its receipt
+	 * omits it.
+	 */
+	requestedActions?: ReadonlyArray<string>;
 	toolProfile?: ToolProfileName;
 	/**
 	 * Whether Clio observed a complete start/finish stream for this runtime's
@@ -635,7 +648,8 @@ export interface RunReceiptSafetySummary {
 		count: number;
 		stateHash: string;
 	};
-	runtimeLimitations: ReadonlyArray<string>;
+	/** Worker runtime limitations. Worker receipts always carry it; main-agent receipts omit it. */
+	runtimeLimitations?: ReadonlyArray<string>;
 }
 
 export interface RunReceiptReproducibility {
@@ -683,6 +697,8 @@ export interface RunReceiptOutput {
 	text: string;
 	bytes: number;
 	truncated: boolean;
+	/** Host-validated internal handoff; text retains the same payload as canonical JSON. */
+	structured?: import("../agents/result-contract.js").StructuredHelperResult;
 }
 
 export type RunAutonomyEnforcementGrade = "mediated" | "approximated" | "bypassed";
@@ -916,6 +932,17 @@ export interface RunReceipt {
 	/** How this runtime enforced the run's captured autonomy level. */
 	autonomyEnforcement?: RunReceiptAutonomyEnforcement;
 	safety?: RunReceiptSafetySummary;
+	/**
+	 * Whether the run changed nothing it was allowed to change: a tool call was
+	 * blocked and no mutating call succeeded, or tools ran and none succeeded.
+	 * A mutating call is one the tool registry classified as action class
+	 * `write` at admission, the class autonomy `auto-edit` runs without asking.
+	 * A run that called no tool is not a no-op. Headless main-agent receipts
+	 * always carry it; `clio-coder run --fail-on-noop` turns a true value into
+	 * a failed run. Absent on worker receipts and on receipts written before
+	 * the field existed.
+	 */
+	noop?: boolean;
 	reproducibility?: RunReceiptReproducibility;
 	/** Effective target/runtime/model/thinking/capability decision for this run. */
 	runtimeResolution?: RuntimeTargetSnapshot;

package/src/domains/dispatch/worker-model-loads.ts

@@ -0,0 +1,66 @@
+/**
+ * Intake for the models dispatched workers load (#379). A worker pins every
+ * Ollama model it loads with `keep_alive: -1` and exits without releasing it,
+ * because releasing on each worker exit would reload the model for every
+ * sequential dispatch and pull it out from under a parallel sibling. The
+ * orchestrator owns the release instead: each worker report is adopted into
+ * this process's residency registries, which keeps the model out of mid-session
+ * eviction and lets the release on exit reclaim it.
+ *
+ * A report carries ids only. The endpoint and any headers come from this
+ * process's own resolved target, never from the worker.
+ */
+
+import { adoptWorkerLoadedModel } from "../../engine/apis/residency.js";
+import type { RuntimeDescriptor, TargetDescriptor } from "../providers/index.js";
+import type { RunNodeIdentity } from "./types.js";
+import type { WorkerModelLoad } from "./worker-protocol.js";
+
+export interface WorkerModelLoadRoute {
+	target: TargetDescriptor;
+	runtime: RuntimeDescriptor;
+	wireModelId: string;
+	node: RunNodeIdentity;
+}
+
+function isLoopbackUrl(url: string): boolean {
+	let host: string;
+	try {
+		host = new URL(url).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return (
+		host === "localhost" ||
+		host.endsWith(".localhost") ||
+		host === "[::1]" ||
+		host === "0.0.0.0" ||
+		/^127(\.\d{1,3}){3}$/u.test(host)
+	);
+}
+
+/**
+ * Adopt one worker report for the route the orchestrator admitted. Returns
+ * false, adopting nothing, when the report names another target or model than
+ * the admitted route, or when this process cannot reach the server the worker
+ * loaded on: a loopback URL on a remote fleet node resolves to that node, not
+ * to this host.
+ */
+export function adoptWorkerModelLoad(load: WorkerModelLoad, route: WorkerModelLoadRoute): boolean {
+	if (load.targetId !== route.target.id || load.modelId !== route.wireModelId) return false;
+	let baseUrl: string | undefined;
+	let headers: Record<string, string> = {};
+	try {
+		const model = route.runtime.synthesizeModel(route.target, route.wireModelId, null);
+		baseUrl = model.baseUrl;
+		headers = { ...(model.headers ?? {}) };
+	} catch {
+		return false;
+	}
+	if (!baseUrl) return false;
+	if (route.node.kind !== "local" && isLoopbackUrl(baseUrl)) return false;
+	return adoptWorkerLoadedModel(
+		{ runtimeId: route.runtime.id, baseUrl, headers },
+		{ modelId: load.modelId, aliasIds: [...load.aliasIds] },
+	);
+}

package/src/domains/dispatch/worker-protocol.ts

@@ -11,6 +11,9 @@
  */
 
 import { createHash } from "node:crypto";
+import type { ToolName } from "../../core/tool-names.js";
+import { attestedToolSignature } from "../../engine/worker-tools.js";
+import type { ToolProfileName } from "../../tools/profiles.js";
 import {
 	canonicalJson,
 	endpointIdentityHash,
@@ -31,6 +34,7 @@ export type {
 	AgentLedgerPort,
 	WorkerAttestation,
 	WorkerControlFrame,
+	WorkerModelLoad,
 	WorkerResourceFacts,
 	WorkerResourceValue,
 } from "../../worker/protocol.js";
@@ -133,6 +137,11 @@ export function approvedIdentityForSpec(spec: {
 	wireModelId: string;
 	target: { id: string; url?: string };
 	allowedTools: ReadonlyArray<string>;
+	helperResult?: true;
+	toolProfile?: ToolProfileName;
+	agentId?: string;
+	task?: string;
+	runtimeResolution?: { capabilities: { tools: boolean | null } };
 }): ApprovedWorkerIdentity {
 	return {
 		specVersion: spec.specVersion,
@@ -145,7 +154,17 @@ export function approvedIdentityForSpec(spec: {
 		// The spec carries the final runtime-narrowed admission surface. The
 		// worker fingerprints its independently resolved registry intersection,
 		// so a missing, added, or differently filtered tool fails admission.
-		toolSignature: toolSignatureOf(spec.allowedTools),
+		toolSignature:
+			spec.helperResult === true
+				? attestedToolSignature({
+						allowedTools: spec.allowedTools as ReadonlyArray<ToolName>,
+						toolsSupported: spec.runtimeResolution?.capabilities.tools === true,
+						helperResult: true,
+						...(spec.toolProfile !== undefined ? { toolProfile: spec.toolProfile } : {}),
+						...(spec.agentId !== undefined ? { agentId: spec.agentId } : {}),
+						...(spec.task !== undefined ? { task: spec.task } : {}),
+					})
+				: toolSignatureOf(spec.allowedTools),
 	};
 }
 

package/src/domains/dispatch/worker-spawn.ts

@@ -28,7 +28,11 @@ import { type ChildProcess, spawn } from "node:child_process";
 import { join } from "node:path";
 import { performance } from "node:perf_hooks";
 import { withClioAgentEnvironment } from "../../core/agent-environment.js";
-import { enableClioCompileCache, workerCompileCacheEnvironment } from "../../core/compile-cache.js";
+import {
+	enableClioCompileCache,
+	publishClioCompileCache,
+	workerCompileCacheEnvironment,
+} from "../../core/compile-cache.js";
 import { resolvePackageRoot } from "../../core/package-root.js";
 import type { WorkerSpec } from "../../worker/spec-contract.js";
 import type { HeartbeatStamp } from "./heartbeat.js";
@@ -46,6 +50,7 @@ import {
 	WORKER_STDIN_QUEUE_MAX_BYTES,
 	type WorkerAttestation,
 	WorkerChannelFailure,
+	type WorkerModelLoad,
 } from "./worker-protocol.js";
 
 export type { WorkerSpec } from "../../worker/spec-contract.js";
@@ -127,6 +132,13 @@ export interface WorkerProcessOptions {
 	 * admission record, so this callback only ever receives a validated body.
 	 */
 	onLedgerPost?: (body: AgentLedgerBody) => void;
+	/**
+	 * One model the worker's request loaded and pinned. The orchestrator owns the
+	 * release of worker loads, so dispatch adopts each report into its own
+	 * residency registries. Delivered only after the announce is accepted, so a
+	 * report always belongs to an admitted identity.
+	 */
+	onModelLoaded?: (load: WorkerModelLoad) => void;
 	/**
 	 * Identity the plan approved. Defaults to the identity of the spec actually
 	 * written to stdin, which is what every production caller wants; a caller
@@ -416,6 +428,14 @@ export function spawnWorkerProcess(
 			opts?.onLedgerPost?.(frame.value.body);
 			return;
 		}
+		if (frame.value.kind === "model_loaded") {
+			if (!announceAccepted) {
+				appendStderr("[worker] dropped a model load report that arrived before attestation was accepted\n");
+				return;
+			}
+			opts?.onModelLoaded?.(frame.value.load);
+			return;
+		}
 		opts?.onControl?.({ kind: frame.value.kind });
 	}
 
@@ -642,6 +662,12 @@ export function spawnNativeWorker(spec: WorkerSpec, opts?: SpawnOptions): Spawne
  * process.env right after Node reads it, so the cache serves Clio's own
  * entry graph and never the user's node processes.
  */
+let publishedCompileCache = false;
 function withCompileCacheEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-	return workerCompileCacheEnvironment(env, enableClioCompileCache());
+	const directory = enableClioCompileCache();
+	if (!publishedCompileCache && directory !== null) {
+		publishClioCompileCache();
+		publishedCompileCache = true;
+	}
+	return workerCompileCacheEnvironment(env, directory);
 }

package/src/domains/eval/artifacts/redact.ts

@@ -9,6 +9,15 @@ const CREDENTIAL_PATTERNS: Array<[RegExp, string]> = [
 	[/\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret)\s*[:=]\s*)[^\s"',}]+/gi, "$1[redacted]"],
 ];
 
+/**
+ * True when storage would replace this key's value with `[redacted]`. Callers
+ * that admit caller-named keys use it to refuse such a key up front rather than
+ * let a measured number turn into a string on write.
+ */
+export function isRedactedArtifactKey(key: string): boolean {
+	return SENSITIVE_KEY.test(key);
+}
+
 export function redactArtifactForStorage<T>(value: T, env: NodeJS.ProcessEnv = process.env): T {
 	return redactValue(value, env) as T;
 }

package/src/domains/eval/metrics/noop.ts

@@ -0,0 +1,61 @@
+/**
+ * No-op scoring for one eval item (#378).
+ *
+ * A headless main-agent run seals `noop` into the receipt it writes to its
+ * state journal and prints no receipt on stdout, so the runner's parsed
+ * receipt never carries it. The item's own journal does. The journal can hold
+ * more than one receipt (dispatched workers, retries), so the receipt is
+ * matched to this item's run by the session the run announced in its
+ * `--json` header: the one root main-agent receipt sealed for that session.
+ * Anything short of exactly one match leaves the item unscored, which keeps
+ * the outcome it had before the field existed.
+ */
+
+import type { RunReceipt } from "../../dispatch/types.js";
+import type { EvalRunJournal } from "./invariants.js";
+
+const MAIN_AGENT_ID = "main-agent";
+const REASON_ATTEMPTS_LIMIT = 5;
+
+/** The session id from the first `session` header line of a `run --json` stream. */
+function sessionIdFromRunJsonStdout(stdout: string): string | null {
+	for (const line of stdout.split(/\r?\n/)) {
+		if (!line.startsWith("{")) continue;
+		let parsed: unknown;
+		try {
+			parsed = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) continue;
+		const record = parsed as Record<string, unknown>;
+		if (record.type !== "session") continue;
+		return typeof record.id === "string" && record.id.length > 0 ? record.id : null;
+	}
+	return null;
+}
+
+/** The root main-agent receipt this item's run sealed, or null unless exactly one matches. */
+export function mainAgentReceiptForRun(journal: EvalRunJournal | null, runnerStdout: string): RunReceipt | null {
+	if (journal === null) return null;
+	const sessionId = sessionIdFromRunJsonStdout(runnerStdout);
+	if (sessionId === null) return null;
+	const matches = journal.receipts.filter(
+		(receipt) =>
+			receipt.agentId === MAIN_AGENT_ID &&
+			receipt.sessionId === sessionId &&
+			(receipt.lineage === undefined || receipt.lineage.rootRunId === receipt.runId),
+	);
+	return matches.length === 1 ? (matches[0] ?? null) : null;
+}
+
+/** Why a no-op receipt changed nothing: its blocked calls when it recorded any. */
+export function noopFailureReason(receipt: RunReceipt): string {
+	const attempts = receipt.safety?.blockedAttempts ?? [];
+	if (attempts.length === 0) return "no-op run: no mutating tool call succeeded";
+	const shown = attempts
+		.slice(0, REASON_ATTEMPTS_LIMIT)
+		.map((attempt) => `${attempt.tool} (${attempt.reason ?? attempt.reasonCode ?? "no reason recorded"})`);
+	const hidden = attempts.length - shown.length + (receipt.safety?.blockedAttemptsTruncated ?? 0);
+	return `no-op run: blocked ${shown.join("; ")}${hidden > 0 ? `; and ${hidden} more` : ""}`;
+}

package/src/domains/eval/reports/junit.ts

@@ -10,7 +10,11 @@ export function renderEvalJunitReportV4(artifact: EvalArtifactV4): string {
 			);
 			if (!result.pass) {
 				failures += 1;
-				return `  <testcase name="${name}"><failure message="${escapeXml(result.failureClass ?? "failed")}" /></testcase>`;
+				const message = escapeXml(result.failureClass ?? "failed");
+				const reason = result.artifacts.failureReason;
+				return typeof reason === "string"
+					? `  <testcase name="${name}"><failure message="${message}">${escapeXml(reason)}</failure></testcase>`
+					: `  <testcase name="${name}"><failure message="${message}" /></testcase>`;
 			}
 			const outcome = result.behavioral?.outcome;
 			if (outcome === "behavioral_failure" || outcome === "infrastructure_failure") {

package/src/domains/eval/reports/text.ts

@@ -30,6 +30,13 @@ export function renderEvalTextReportV4(artifact: EvalArtifactV4): string {
 				: `tokens total: ${tokens.total} (measured in ${tokens.measuredRuns} of ${tokens.runs} runs)`,
 		`wall time ms: ${artifact.summary.wallTimeMs}`,
 		...behavioralSummary,
+		...artifact.results.flatMap((result) => {
+			const reason = result.artifacts.failureReason;
+			if (result.pass || typeof reason !== "string") return [];
+			return [
+				`failure: ${result.taskId}[${result.target.id}:${result.target.model ?? "default"}:${result.repeatIndex}] ${result.failureClass ?? "failed"}: ${reason}`,
+			];
+		}),
 		"",
 	].join("\n");
 }

package/src/domains/eval/runners/clio-run.ts

@@ -20,6 +20,7 @@ export async function runClioRunRunner(
 	target: EvalSuiteTargetV2,
 	env?: NodeJS.ProcessEnv,
 	readObservation?: { allowedPaths: string[]; decoyPaths: string[] },
+	onStdout?: (chunk: string) => void,
 ): Promise<EvalRunnerOutput> {
 	const prompt = runner.prompt ?? "";
 	// Spawned as an argv, not a shell line: the task timeout has to reach the
@@ -38,7 +39,7 @@ export async function runClioRunRunner(
 		...(runner.autonomy === undefined ? [] : ["--autonomy", runner.autonomy]),
 		prompt,
 	];
-	const result = await runShellCommand(args, cwd, runner.timeoutMs ?? timeoutMs, env);
+	const result = await runShellCommand(args, cwd, runner.timeoutMs ?? timeoutMs, env, onStdout);
 	// Usage is folded from the live stream, not from the bounded stdout
 	// artifact: a verbose run's `message_end` events do not survive truncation.
 	const tokens = result.usage;
@@ -158,7 +159,7 @@ export function toolBehaviorMetricEntriesFromJsonl(
 	cwd: string,
 	readObservation?: { allowedPaths: string[]; decoyPaths: string[] },
 ): Record<string, number> {
-	const starts = new Map<string, { tool: string; path: string | null }>();
+	const starts = new Map<string, { tool: string; path: string | null; capability?: string }>();
 	const readPaths = new Set<string>();
 	const executionEnds: BehavioralToolTerminal[] = [];
 	const canonicalFinishes: BehavioralToolTerminal[] = [];
@@ -180,7 +181,11 @@ export function toolBehaviorMetricEntriesFromJsonl(
 			const tool = stringField(event, "toolName");
 			if (callId === undefined || tool === undefined) continue;
 			const path = tool === "read" && isRecord(event.args) ? toolPath(event.args) : null;
-			starts.set(callId, { tool, path });
+			const capability =
+				tool === "gateway" && isRecord(event.args) && event.args.op === "call" && typeof event.args.capability === "string"
+					? event.args.capability
+					: undefined;
+			starts.set(callId, { tool, path, ...(capability ? { capability } : {}) });
 			if (path !== null) readPaths.add(normalizeObservedPath(cwd, path));
 			continue;
 		}
@@ -209,11 +214,17 @@ export function toolBehaviorMetricEntriesFromJsonl(
 	const failed = new Map<string, number>();
 	const blocked = new Map<string, number>();
 	for (const terminal of terminals) {
-		const tool = metricToolName(terminal.tool);
-		calls.set(tool, (calls.get(tool) ?? 0) + 1);
-		if (terminal.outcome === "ok") succeeded.set(tool, (succeeded.get(tool) ?? 0) + 1);
-		if (terminal.outcome === "blocked") blocked.set(tool, (blocked.get(tool) ?? 0) + 1);
-		if (terminal.outcome === "error") failed.set(tool, (failed.get(tool) ?? 0) + 1);
+		// A gateway invocation is one model call, with an additional capability
+		// attribution. Discovery/description never count as capability execution.
+		const capability = terminal.callId === null ? undefined : starts.get(terminal.callId)?.capability;
+		const names = new Set([terminal.tool, ...(capability ? [capability] : [])]);
+		for (const name of names) {
+			const tool = metricToolName(name);
+			calls.set(tool, (calls.get(tool) ?? 0) + 1);
+			if (terminal.outcome === "ok") succeeded.set(tool, (succeeded.get(tool) ?? 0) + 1);
+			if (terminal.outcome === "blocked") blocked.set(tool, (blocked.get(tool) ?? 0) + 1);
+			if (terminal.outcome === "error") failed.set(tool, (failed.get(tool) ?? 0) + 1);
+		}
 	}
 	const namedTools = new Set([...ALL_TOOL_NAMES, ...calls.keys()]);
 	const entries: Record<string, number> = { "tools.read.distinctPaths": readPaths.size };