@juzser/blacksmith 0.3.0 → 0.5.0

package/factory/orchestrator/dist/worktree.js

@@ -3,7 +3,7 @@ import { SmithError } from './errors.js';
 import { runGit as git } from './git.js';
 export class WorktreeError extends SmithError {
 }
-/** The task-id segment reserved for an epic's integration branch (smith/<epic>/integration) —
+/** The task-id segment reserved for an epic's integration branch (<prefix>/<epic>/integration) —
  * never a real task. Exported for db/projector.ts's foldTasks() guard and epic.ts's
  * runEpicVerdict(), both of which need to recognise `<epic>/integration` as non-task. */
 export const RESERVED_TASK_ID = 'integration';
@@ -16,6 +16,19 @@ function localBranchExists(projectDir, branch) {
         return false;
     }
 }
+/**
+ * Whether a task's own branch (`taskBranchName`) already exists locally —
+ * i.e. whether the task has already been cut. Exported for cli.ts's
+ * `worktree create --from` guard: spec.ts's `successorChainPath` hands back
+ * the bare hop ids between a `--from` predecessor and its target purely from
+ * the event log, with no notion of git state; this is the git-aware
+ * predicate the guard pairs it with to refuse skipping past a hop that was
+ * already cut (`createTaskWorktree` branches straight off `--from`'s own
+ * branch, so a cut hop's commits would otherwise vanish silently).
+ */
+export function taskBranchExists(projectDir, epic, taskId) {
+    return localBranchExists(projectDir, taskBranchName(epic, taskId, epicBranchPrefix(projectDir, epic)));
+}
 /**
  * Best-effort default-branch detection: origin/HEAD symbolic ref first (the
  * normal case after a clone), then whatever branch is currently checked out,
@@ -92,13 +105,39 @@ export function taskWorktreeDir(projectDir, epic, taskId) {
     const project = path.resolve(projectDir);
     return path.join(path.dirname(project), '.wt', path.basename(project), bareTaskId(epic, taskId));
 }
-/** `smith/<epic>/integration` — the one branch an epic assembles onto. Exported for
- * integration.ts, which runs the check suite against it (D-42/P9-26). */
-export function integrationBranchName(epic) {
-    return `smith/${epic}/integration`;
+/** The branch prefix every new epic gets (bs-rename operator decision 1). */
+export const BRANCH_PREFIX = 'bs';
+/** The prefix `BRANCH_PREFIX` replaced. Still recognised so an epic already
+ * cut under it keeps landing new branches there (operator decision 3) rather
+ * than splitting one epic's worktrees across two branch families. */
+export const LEGACY_BRANCH_PREFIX = 'smith';
+/**
+ * Which prefix THIS epic's factory branches use: `smith` when
+ * `smith/<epic>/integration` already exists locally, `bs` otherwise —
+ * including for a brand-new epic, which has neither yet. Git-aware on
+ * purpose: this is the one place that decides, so integrationBranchName and
+ * taskBranchName can stay pure string joins driven by whatever prefix their
+ * caller resolved (or hands the bs default straight through, for the
+ * git-free callers — taskEvents.ts and db/projector.ts's fallback — that
+ * have no projectDir to ask).
+ */
+export function epicBranchPrefix(projectDir, epic) {
+    return localBranchExists(projectDir, `${LEGACY_BRANCH_PREFIX}/${epic}/${RESERVED_TASK_ID}`)
+        ? LEGACY_BRANCH_PREFIX
+        : BRANCH_PREFIX;
+}
+/** `<prefix>/<epic>/integration` — the one branch an epic assembles onto.
+ * `prefix` defaults to BRANCH_PREFIX (`bs`); a caller with a projectDir
+ * passes `epicBranchPrefix(projectDir, epic)` to get the epic's actual
+ * prefix, legacy `smith/` included. Exported for integration.ts, which runs
+ * the check suite against it (D-42/P9-26). */
+export function integrationBranchName(epic, prefix = BRANCH_PREFIX) {
+    return `${prefix}/${epic}/integration`;
 }
 /**
- * `smith/<epic>/<bare-task-id>` — the branch convention, defined once.
+ * `<prefix>/<epic>/<bare-task-id>` — the branch convention, defined once.
+ * `prefix` defaults to BRANCH_PREFIX (`bs`) for the same reason as
+ * integrationBranchName above.
  *
  * D-23/P9-12: exported because three places need to agree on it — this module
  * (which creates the branch), taskEvents.ts's `task-added` (which declares it
@@ -108,14 +147,14 @@ export function integrationBranchName(epic) {
  *
  * A task_id already embeds its epic ("epic-7/task-142", findings.ts's
  * convention) so strip that prefix before rejoining — concatenating epic +
- * full task_id double-embeds it (smith/epic-7/epic-7/task-142). The CLI hands
+ * full task_id double-embeds it (bs/epic-7/epic-7/task-142). The CLI hands
  * this whatever the operator typed, so both shapes really do arrive.
  */
-export function taskBranchName(epic, taskId) {
-    return `smith/${epic}/${bareTaskId(epic, taskId)}`;
+export function taskBranchName(epic, taskId, prefix = BRANCH_PREFIX) {
+    return `${prefix}/${epic}/${bareTaskId(epic, taskId)}`;
 }
 function ensureIntegrationBranch(projectDir, epic) {
-    const branch = integrationBranchName(epic);
+    const branch = integrationBranchName(epic, epicBranchPrefix(projectDir, epic));
     if (!localBranchExists(projectDir, branch)) {
         const defaultBranch = detectDefaultBranch(projectDir);
         git(projectDir, ['branch', branch, defaultBranch]);
@@ -127,24 +166,39 @@ function ensureIntegrationBranch(projectDir, epic) {
  * sibling of whatever directory the project was handed as, never a path of
  * this module's own choosing, so a project outside this clone keeps its
  * worktrees outside it too (see taskWorktreeDir)
- * on branch smith/<epic>/<task-id>, cut from the CURRENT head of
- * smith/<epic>/integration (creating the integration branch from the default
- * branch first if it doesn't exist yet).
+ * on branch <prefix>/<epic>/<task-id>, where <prefix> is epicBranchPrefix's
+ * answer for this epic (`bs`, or `smith` for an epic already cut under it).
+ *
+ * Without `opts.from`, cut from the CURRENT head of <prefix>/<epic>/integration
+ * (creating the integration branch from the default branch first if it
+ * doesn't exist yet). With `opts.from`, cut from <prefix>/<epic>/<from> instead
+ * — the predecessor's branch, commits and all — and integration is never
+ * consulted.
  */
-export function createTaskWorktree(projectDir, epic, taskId) {
+export function createTaskWorktree(projectDir, epic, taskId, opts = {}) {
     if (taskId === RESERVED_TASK_ID) {
         throw new WorktreeError('worktree.reserved-task-id', `Task id "${RESERVED_TASK_ID}" is reserved for the integration branch itself.`, { taskId });
     }
-    const integrationBranch = ensureIntegrationBranch(projectDir, epic);
-    const branch = taskBranchName(epic, taskId);
+    const prefix = epicBranchPrefix(projectDir, epic);
+    const branch = taskBranchName(epic, taskId, prefix);
     const worktreeDir = taskWorktreeDir(projectDir, epic, taskId);
-    git(projectDir, ['worktree', 'add', '-b', branch, worktreeDir, integrationBranch]);
+    let sourceBranch;
+    if (opts.from !== undefined) {
+        sourceBranch = taskBranchName(epic, opts.from, prefix);
+        if (!localBranchExists(projectDir, sourceBranch)) {
+            throw new WorktreeError('worktree.from-missing', `Predecessor branch ${sourceBranch} does not exist; cannot cut ${taskId} from it.`, { epic, taskId, from: opts.from, branch: sourceBranch });
+        }
+    }
+    else {
+        sourceBranch = ensureIntegrationBranch(projectDir, epic);
+    }
+    git(projectDir, ['worktree', 'add', '-b', branch, worktreeDir, sourceBranch]);
     return { worktreeDir, branch, epic, taskId };
 }
 /** Remove a task's worktree and its local branch after it has merged. */
 export function removeTaskWorktree(projectDir, epic, taskId) {
     const worktreeDir = taskWorktreeDir(projectDir, epic, taskId);
-    const branch = taskBranchName(epic, taskId);
+    const branch = taskBranchName(epic, taskId, epicBranchPrefix(projectDir, epic));
     try {
         git(projectDir, ['worktree', 'remove', worktreeDir]);
     }
@@ -180,12 +234,13 @@ function parseWorktreePorcelain(output) {
     return entries;
 }
 /**
- * List task worktrees whose branch is fully merged into smith/<epic>/integration.
+ * List task worktrees whose branch is fully merged into <prefix>/<epic>/integration.
  * Reports only — never deletes.
  */
 export function listStale(projectDir, epic) {
-    const integrationBranch = integrationBranchName(epic);
-    const prefix = `smith/${epic}/`;
+    const branchPrefix = epicBranchPrefix(projectDir, epic);
+    const integrationBranch = integrationBranchName(epic, branchPrefix);
+    const prefix = `${branchPrefix}/${epic}/`;
     const porcelain = git(projectDir, ['worktree', 'list', '--porcelain']);
     const entries = parseWorktreePorcelain(porcelain);
     const stale = [];

package/factory/orchestrator/drizzle/0013_operator_feedback.sql

@@ -0,0 +1,19 @@
+CREATE TABLE `operator_feedback` (
+	`id` text PRIMARY KEY NOT NULL,
+	`task_id` text NOT NULL,
+	`session_id` text NOT NULL,
+	`body` text NOT NULL,
+	`kind` text NOT NULL,
+	`source` text NOT NULL,
+	`external_id` text,
+	`author` text,
+	`recorded_at` text NOT NULL,
+	`recorded_event_id` text NOT NULL,
+	`resolved_at` text,
+	`resolution` text,
+	`follow_up_task_id` text
+);
+--> statement-breakpoint
+CREATE INDEX `operator_feedback_task_idx` ON `operator_feedback` (`task_id`);--> statement-breakpoint
+CREATE INDEX `operator_feedback_session_idx` ON `operator_feedback` (`session_id`);--> statement-breakpoint
+CREATE INDEX `operator_feedback_external_idx` ON `operator_feedback` (`external_id`);

package/factory/orchestrator/drizzle/0014_misty_madripoor.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `tasks` ADD `title` text;--> statement-breakpoint
+ALTER TABLE `tasks` ADD `summary` text;

package/factory/orchestrator/drizzle/0015_gifted_omega_flight.sql

@@ -0,0 +1 @@
+ALTER TABLE `tasks` ADD `terminal_at` text;

package/factory/orchestrator/drizzle/0016_milestones_project_default.sql

@@ -0,0 +1,30 @@
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_milestones` (
+	`milestone_id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`status` text NOT NULL,
+	`sequence` integer NOT NULL,
+	`goal` text,
+	`epic_ids` text NOT NULL,
+	`project` text DEFAULT 'blacksmith' NOT NULL,
+	`kind` text DEFAULT 'factory' NOT NULL,
+	`error_issues` integer DEFAULT true NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO `__new_milestones`("milestone_id", "name", "status", "sequence", "goal", "epic_ids", "project", "kind", "error_issues") SELECT "milestone_id", "name", "status", "sequence", "goal", "epic_ids", "project", "kind", "error_issues" FROM `milestones`;--> statement-breakpoint
+DROP TABLE `milestones`;--> statement-breakpoint
+ALTER TABLE `__new_milestones` RENAME TO `milestones`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE INDEX `milestones_project_idx` ON `milestones` (`project`);--> statement-breakpoint
+-- The factory's own project was renamed from 'black-smith' to 'blacksmith'.
+-- History (events, committed plan files, old roadmap.md bullets) keeps the
+-- old spelling, but every table's read model should not: rewrite every row
+-- that already carries the old name in every table with a project column.
+UPDATE `events_raw` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `dispatches` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `tasks` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `errors` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `findings` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `epics` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `milestones` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';--> statement-breakpoint
+UPDATE `issue_reports` SET `project` = 'blacksmith' WHERE `project` = 'black-smith';

package/factory/orchestrator/drizzle/0017_events_raw_cli_session_id.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `events_raw` ADD `cli_session_id` text;--> statement-breakpoint
+CREATE INDEX `events_raw_cli_session_idx` ON `events_raw` (`cli_session_id`);

package/factory/orchestrator/drizzle/meta/_journal.json

@@ -92,6 +92,41 @@
       "when": 1789464480602,
       "tag": "0012_issue_reports_error_issues",
       "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1790738459253,
+      "tag": "0013_operator_feedback",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1790818969124,
+      "tag": "0014_misty_madripoor",
+      "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "6",
+      "when": 1790924037810,
+      "tag": "0015_gifted_omega_flight",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "6",
+      "when": 1791191766572,
+      "tag": "0016_milestones_project_default",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1791262161043,
+      "tag": "0017_events_raw_cli_session_id",
+      "breakpoints": true
     }
   ]
 }

package/factory/policies/budgets.yml

@@ -6,23 +6,24 @@
 # What is mechanical, and what is a request (P9-18, 2026-08-08; `failed_rounds`
 # added P9-32 and `alarm_ratio` P9-33, both 2026-08-10; `max_in_flight_tasks`
 # added 2026-08-26, the same day `epic.cap_tokens` grew a reader that actually
-# blocks). Exactly six numbers here reach a runtime host:
+# blocks). Exactly six kinds of number here reach a runtime host — each one
+# sized per effort tier, see "Effort tiers" below:
 #
 #   * `epic.cap_tokens` — three readers now, and only the newest of them
 #     blocks. planQuorum's budget trigger sums *declared* task budgets against
 #     it before any dispatch and only ever surfaces the finding for a human to
-#     act on; `smith budget alarm` compares it against spend counted from the
-#     event log, after wave merge, and also stops nothing itself. `smith wave
+#     act on; `bs budget alarm` compares it against spend counted from the
+#     event log, after wave merge, and also stops nothing itself. `bs wave
 #     check` (src/waveBudget.ts) is the reader that blocks: at wave admission —
 #     before any task in the wave has been dispatched — it sums the wave's
 #     declared task budgets against headroom under the cap (measured spend plus
 #     a declared price for every dispatch nothing has measured yet, the same
-#     projection `smith budget alarm` computes) and refuses to admit a wave
+#     projection `bs budget alarm` computes) and refuses to admit a wave
 #     that would cross it. It is not a stricter version of the other two
 #     readers' advice; it is the only one of the three standing upstream of the
 #     spend it is judging, so it is the only one that can refuse the spend
 #     instead of merely describing it afterward.
-#   * `epic.alarm_ratio` — `smith budget alarm` (src/budgetAlarm.ts), which
+#   * `epic.alarm_ratio` — `bs budget alarm` (src/budgetAlarm.ts), which
 #     reports each epic's measured and projected spend against
 #     `alarm_ratio * cap_tokens` and exits 1 on a crossing. Measured spend is a
 #     floor, not a total: a judge returns findings rather than a Result, so its
@@ -32,14 +33,17 @@
 #     `task:` block's coverage of the roles the factory actually dispatches is
 #     load-bearing and not merely documentary.
 #   * a task's `tokens` — compared at the gate against the result's
-#     `token_usage.total_tokens`.
+#     `token_usage.total_tokens`. The per-role caps under `task:` are what
+#     `bs budget alarm` and `bs wave check` charge a dispatch nothing has
+#     measured yet, and what the dispatch harness hands a CLI turn as its
+#     `cap_tokens`.
 #   * a task's `diff_lines` — compared at the gate against a real
 #     `git diff --numstat` (src/diffstat.ts), lockfiles and generated output
 #     excluded.
 #   * `escalation_ladder.rungs[].failed_rounds` — counted from `gate-outcome`
-#     events by `smith escalation check` (src/escalation.ts), which asserts the
+#     events by `bs escalation check` (src/escalation.ts), which asserts the
 #     rung's `enforce` obligation against what the log shows happened next.
-#   * `epic.max_in_flight_tasks` — `smith wave check`, which refuses to admit a
+#   * `epic.max_in_flight_tasks` — `bs wave check`, which refuses to admit a
 #     wave that would put more of the epic's tasks in flight at once (admitted,
 #     not yet merged) than this. Null by default; see the field's own comment
 #     below for why it is not the mechanism that bounds cost.
@@ -51,7 +55,7 @@
 # measuring (D-29: a coder spent its tail shaving lines to land exactly on
 # `diff_lines`, stopping mid-procedure to do it).
 #
-# The epic cap no longer works that way: `smith wave check` blocks on one.
+# The epic cap no longer works that way: `bs wave check` blocks on one.
 # The difference is not that an epic overrun matters more than a task overrun
 # — it is *when* each is checked. The task gate polices work already
 # underway, so refusing there distorts the work it is judging. Wave admission
@@ -68,13 +72,48 @@
 # agent-interviews.md M-4 had called it inert), and a plan cannot raise or
 # lower a role's ceiling. So plan validation rejects it as a task budget
 # field, and the dispatch prompt restates the template's number verbatim.
+# It is one number per template, not per tier: a template cannot know the
+# epic it will be dispatched into, so each `maxTurns` is sized as the ceiling
+# for the huge tier (raised 2026-09-29, measured on eight medium-tier dogfood
+# epics, 2026-09-14..29). The token caps below are what scale down for a
+# smaller epic; the turn ceiling does not.
+#
+# Effort tiers (2026-09-29). Every token and diff number in this file is sized
+# per effort tier — effort.yml's small / medium / huge: the tier the epic
+# runs at, i.e. its plan's `effort` raised by effort.yml's `security_floor`
+# when a live task trips a security trigger, and effort.yml's `default_tier`
+# (medium) when there is no plan in hand or it names none. One source of
+# truth, one scale:
+#
+#   * `epic.cap_tokens` is an explicit triplet, because an epic's size is not
+#     a straight multiple of its tasks'.
+#   * every `task:` number is declared once, at medium, and multiplied by
+#     `task_tier_scale` for the tier: small 0.5x, huge 2x.
+#   * `epic.alarm_ratio` is a ratio and is the same at every tier.
+#
+# Per-box env overrides (`.env`, or an exported value, which beats it). Each
+# number that a box may want to move has an env name — BS_EPIC_CAP_TOKENS,
+# BS_TASK_<ROLE>_CAP_TOKENS, … listed in .env.example (the deprecated
+# SMITH_* spellings still work as a fallback) — and each name has a
+# `_SMALL`, `_MEDIUM` and `_HUGE` variant. For an epic of a given tier the
+# precedence is, highest first:
+#
+#   1. the variant for that tier, e.g. BS_EPIC_CAP_TOKENS_HUGE;
+#   2. the bare name, e.g. BS_EPIC_CAP_TOKENS, which applies to every tier
+#      that has no variant of its own set;
+#   3. the number in this file for that tier.
+#
+# An env value beats the tier: a bare name pins one number for every tier. A
+# malformed value in any variant — even one for a tier not in play — is
+# refused with `budgets.invalid-env`. `bs wave check` and `bs budget
+# alarm` name the variables that moved a number, never their values.
 #
 # No concurrency cap on cost grounds, by design (removed 2026-08-05). Workers
 # run in isolated worktrees on disjoint path claims, so parallelism is bounded
 # by the claim graph, not by a worker count — and fan-out buys wall-clock
 # without buying extra tokens (architecture §15.3). Hundreds of concurrent
 # subagents is a supported shape. That reasoning holds only as long as the
-# token cap it leans on actually binds, which — before `smith wave check` —
+# token cap it leans on actually binds, which — before `bs wave check` —
 # `epic.cap_tokens` did not. `epic.max_in_flight_tasks` below is not that
 # removed cap come back: it defaults to null, and cost stays bounded by
 # `cap_tokens`, not by a worker count. It exists for an operator who wants a
@@ -83,7 +122,22 @@
 # nothing about what bounds spend.
 
 epic:
-  cap_tokens: 4000000        # planner + all workers + judges, one epic.
+  cap_tokens:                # planner + all workers + judges, one epic.
+    small: 4000000
+    medium: 16000000
+    huge: 32000000
+                              # 2026-09-29: per tier. Medium is 16M, the cap
+                              # the operator's own box had already been
+                              # running by env override; the largest measured
+                              # medium epic (eight medium-tier dogfood epics,
+                              # 2026-09-14..29) spent about 7.3M, so 16M
+                              # carries it with the alarm at 11.2M. Small
+                              # keeps the old single number, 4M; huge is 32M.
+                              # This is also the per-epic override follow-up
+                              # (1) below asked for, in the only form a
+                              # policy file can give it: an epic's `effort`
+                              # picks its cap.
+                              # Earlier history:
                               # Raised from 2,000,000 by operator decision on
                               # 2026-08-11 (dogfood-mcp-1), which is the
                               # operator answer the `alarm_ratio` note below
@@ -99,31 +153,32 @@ epic:
                               # so a number raised for one epic is raised for
                               # every epic black-smith will ever run. What
                               # exists is a per-BOX override, a different
-                              # thing: SMITH_EPIC_CAP_TOKENS in the env (or
+                              # thing: BS_EPIC_CAP_TOKENS in the env (or
                               # `.env`) replaces this number for every epic
                               # run on that box while it is set — the
-                              # SMITH_EPIC_* / SMITH_TASK_* names in
+                              # BS_EPIC_* / BS_TASK_* names in
                               # .env.example cover each number in this file
                               # that a box may want to move; (2) a
                               # large share of that 1.5M was rework — stopped
-                              # dispatches and re-dispatches that `smith
+                              # dispatches and re-dispatches that `bs
                               # escalation check` recorded as ladder
                               # violations — so this cap now accommodates
                               # waste as well as work. A cap sized from a
                               # badly-run epic is a ceiling measured at the
                               # wrong place.
-  alarm_ratio: 0.7           # at 2.8M tokens: planner must re-plan remaining
+  alarm_ratio: 0.7           # same at every tier (small: 2.8M, medium:
+                              # 11.2M, huge: 22.4M). At that point: planner must re-plan remaining
                               # work to fit, or ask the operator. Epics that
                               # cannot fit are split at spec time, never
                               # silently extended (extension is always an
-                              # operator question). Checked by `smith budget
+                              # operator question). Checked by `bs budget
                               # alarm <session>`, which the /bs run loop runs at
                               # each wave merge — before P9-33 this number's
                               # only reader was a human remembering to look.
   max_in_flight_tasks: null  # Off by default. "Fan-out buys wall-clock
                               # without buying extra tokens" above is the
                               # standing decision, and it only holds while the
-                              # token cap actually binds — which `smith wave
+                              # token cap actually binds — which `bs wave
                               # check` now makes true. So this is NOT the
                               # mechanism that bounds cost; `cap_tokens` is,
                               # and it is checked regardless of how this field
@@ -131,17 +186,32 @@ epic:
                               # wants a wall-clock or rate-limit bound for a
                               # reason of their own — a provider's
                               # concurrent-request limit, a laptop's CPU count
-                              # — and setting it makes `smith wave check`
+                              # — and setting it makes `bs wave check`
                               # refuse to admit a wave that would put more of
                               # the epic's tasks in flight (admitted, not yet
                               # merged) than this number at once.
 
+task_tier_scale:
+  # Multiplies every `task:` number below for an epic of that tier. Not the
+  # epic cap, which is declared per tier above.
+  small: 0.5
+  medium: 1
+  huge: 2
+
 task:
+  # Medium-tier numbers; `task_tier_scale` gives the small and huge ones.
   # Defaults a planner sizes a task's own `budget` block against. The task's
   # declared numbers are what the gate checks; these are the shape of a
   # reasonable declaration, not a second cap applied on top.
+  #
+  # Sized 2026-09-29 from the p90 tokens per dispatch measured on eight
+  # medium-tier dogfood epics, 2026-09-14..29, rounded up. Before that the
+  # coder cap was 150k (10 of 36 measured coder dispatches over it), the four
+  # judges shared one 40k bucket (31 of 32 spec-reviewer dispatches over it),
+  # researcher was 60k, and planner, tester, security-reviewer and auditor had
+  # no cap at all, which left every epic that used one unverifiable.
   coder:
-    cap_tokens: 150000       # Second reader, added 2026-08-26: `smith wave
+    cap_tokens: 220000       # Second reader, added 2026-08-26: `bs wave
                              # check` prices a task that exists only in the
                              # event log at this number. A follow-up minted by
                              # `findings raise` has claims but no declared
@@ -158,18 +228,38 @@ task:
                              # `budget.tokens` is a different silence and is
                              # still refused — the schema requires that field,
                              # so its absence is a plan that never passed
-                             # `smith plan validate`.
-    cap_diff_lines: 400      # excludes lockfiles/generated files
+                             # `bs plan validate`.
+    cap_diff_lines: 700      # excludes lockfiles/generated files. Measured
+                             # p50 316 / p90 727 lines (was 400); small 350,
+                             # huge 1400.
+  tester:
+    cap_tokens: 60000        # p90 55k
+  planner:
+    cap_tokens: 110000       # p90 103k
   researcher:
-    cap_tokens: 60000
-  judges:                    # spec-reviewer, reviewer, verifier, grader
-    cap_tokens: 40000
-  # Not priced here, and dispatched anyway: security-reviewer, merger, tester,
-  # uiux, planner, scribe. `smith budget alarm` cannot put a number on those
-  # dispatches, so an epic that used one is reported unverifiable rather than
-  # under — the omission is visible instead of free. Left unpriced on purpose
-  # until there is real spend data to size them from; inventing a cap would
-  # make the projection look complete without making it true.
+    cap_tokens: 80000        # p90 74k (was 60k)
+  spec-reviewer:
+    cap_tokens: 170000       # p90 168k (was the shared 40k judges bucket)
+  grader:
+    cap_tokens: 110000       # p90 105k (was 40k)
+  reviewer:
+    cap_tokens: 60000        # p90 56k (was 40k)
+  verifier:
+    cap_tokens: 40000        # p90 25k (unchanged)
+  security-reviewer:
+    cap_tokens: 80000        # p90 77k
+  auditor:
+    cap_tokens: 90000        # p90 89k
+  # The old shared `judges:` bucket is gone. A policy file that still carries
+  # `judges: {cap_tokens: N}` has N read for spec-reviewer, reviewer, verifier
+  # and grader wherever it does not name that role itself.
+  #
+  # Not priced here, and dispatched anyway: merger, uiux, scribe, wave-runner.
+  # `bs budget alarm` cannot put a number on those dispatches, so an epic
+  # that used one is reported unverifiable rather than under — the omission is
+  # visible instead of free. Left unpriced on purpose until there is real spend
+  # data to size them from; inventing a cap would make the projection look
+  # complete without making it true.
 
 pre_code_budget:
   # researcher + uiux together, before any code is written for the epic
@@ -193,7 +283,7 @@ context_window:
                                # quietly loses the contract it was given.
   counts_against_budget: true  # tokens spent before a compaction still count
                                # against the caps above — compacting is not a
-                               # way around the 150k coder cap.
+                               # way around the coder cap.
   compacting_roles: [planner, coder, tester, researcher, uiux, scribe]
   narrowing_roles: [reviewer, verifier, grader, spec-reviewer, security-reviewer, merger, auditor]
   # narrowing_roles hold evidence rather than build on it: a judge that compacts
@@ -219,7 +309,7 @@ escalation_ladder:
   # architecture §12, agent-constraints.md "budgets (factory-wide)"
   #
   # `failed_rounds` and `enforce` are the machine-readable half, added P9-32.
-  # src/escalation.ts reads them and `smith escalation check` asserts them
+  # src/escalation.ts reads them and `bs escalation check` asserts them
   # against the log; `trigger`/`action` stay as the human contract and must say
   # the same thing. A failed round is one `gate-outcome` with outcome
   # `blocked` for the task.
@@ -260,7 +350,7 @@ effort_scaling:
   # and it lives in `factory/policies/effort.yml`: a per-epic tier
   # (small/medium/huge) that scales the deliberation steps — pre-code briefs,
   # spec-review rounds, the plan quorum, grader rounds, verifier severities,
-  # the closing spec review — and nothing else. Ask `smith effort show`; the
+  # the closing spec review — and nothing else. Ask `bs effort show`; the
   # two files do not overlap, and neither may touch a mechanical gate.
   - rule: small fixes get a single coder, not a fan-out.
   - rule: >