@ljwei-stak/dsh-model-router 0.15.0 → 0.16.1

package/.dsh-plugin/index.mjs

@@ -12,9 +12,12 @@ import {
   DEFAULT_COOLDOWN_MINUTES, billingOverview, createQuotaTracker, detectQuotaExhaustion, parseQuotaPatterns, vendorKey,
 } from './shared/subscription-billing.mjs'
 import { createRouterState } from './shared/router-state.mjs'
+import { applyFeedbackProfile, buildFeedbackProfile } from './shared/adaptive-feedback.mjs'
+import { applyPricingSnapshot, createDynamicDataRefresher, dynamicDataSummary, routingData } from './shared/dynamic-data.mjs'
+import { projectDynamicData } from './shared/dynamic-data-view.mjs'
 import {
-  applyQualityBiases, budgetCheck, buildRunRecord, formatUsd, buildTeamRunRecord, buildToolRunRecord, billingOf, mergeRerun,
-  routeQualityBiases, spending, storedResults, actualCost, teamExecutionResults,
+  budgetCheck, buildRunRecord, formatUsd, buildTeamRunRecord, buildToolRunRecord, billingOf, mergeRerun,
+  spending, storedResults, actualCost, teamExecutionResults,
 } from './shared/run-ledger.mjs'
 import { routeBoundaries } from './shared/security-boundaries.mjs'
 import { createPlanFromRoutes } from './shared/harness-plan.mjs'
@@ -62,6 +65,15 @@ export const Config = z.object({
   overBudgetAction: z.union(['downgrade', 'pause']).default('downgrade').volatile(),
   reviewMode: z.union(['off', 'sample', 'always']).default('off').volatile(),
   reviewSampleRate: z.number().min(0).max(1).default(0.2).volatile(),
+  feedbackLearningEnabled: z.boolean().default(true).volatile(),
+  feedbackHalfLifeDays: z.number().min(1).max(3650).default(30).volatile(),
+  feedbackPriorWeight: z.number().min(1).max(1_000_000).default(3).volatile(),
+  feedbackMaxAdjustment: z.number().min(0).max(0.1).default(0.04).volatile(),
+  feedbackResetAt: z.number().min(0).default(0).volatile(),
+  dynamicDataEnabled: z.boolean().default(false).volatile(),
+  liveBenchEndpoint: z.string().max(2048).default('https://livebench.ai').volatile(),
+  pricingSnapshotEndpoint: z.string().max(2048).default('').volatile(),
+  dynamicDataTtlMinutes: z.number().min(1).max(10_080).default(1440).volatile(),
   allowManualReassign: z.boolean().default(true).volatile(),
   confirmUnsandboxedCli: z.boolean().default(true).volatile(),
   subscriptionCooldownMinutes: z.number().step(1).min(1).max(10_080).default(DEFAULT_COOLDOWN_MINUTES).volatile(),
@@ -169,8 +181,14 @@ export function routerStateStore() {
 }
 
 async function savedState() {
-  try { return await routerStateStore().read() }
-  catch { return { onboarding: { completedAt: null }, health: null, runs: [] } }
+  try {
+    const saved = await routerStateStore().read()
+    const storageAvailable = !(saved.notices ?? []).some(notice => notice.kind === 'state-recovery-pending')
+    return { ...saved, storageAvailable, historyVerified: storageAvailable && saved.historyIncomplete !== true }
+  } catch {
+    return { onboarding: { completedAt: null }, health: null, runs: [], storageAvailable: false, historyVerified: false,
+      notices: [{ kind: 'state-read-failed', at: Date.now(), message: '执行记录暂时无法读取，费用与学习摘要尚未核验；请恢复存储连接后重试。' }] }
+  }
 }
 
 const NOTICE_DAYS = 7
@@ -333,6 +351,9 @@ function budgetSettings(config) {
 
 function budgetFor(config, saved, estimateUsd) {
   const settings = budgetSettings(config)
+  if ((saved.storageAvailable === false || saved.historyVerified === false) && (settings.dailyLimitUsd > 0 || settings.monthlyLimitUsd > 0)) {
+    throw new Error('无法读取费用历史，不能核验日/月预算；请恢复存储连接后再执行。')
+  }
   const spent = spending(saved.runs, undefined, saved.archivedSpending)
   return { ...budgetCheck({ estimateUsd, spent, ...settings }), spent, ...settings }
 }
@@ -350,13 +371,62 @@ export function billingForResult(result) {
 }
 
 function routePricing(routes, item) {
-  return routes.find(route => route.provider === item?.provider && route.model === item?.model)?.pricing ?? null
+  const route = routes.find(route => route.provider === item?.provider && route.model === item?.model)
+  return route?.pricing ? { ...route.pricing, source: route.pricingSource ?? 'route', version: route.pricingVersion ?? null, asOf: route.snapshotAsOf ?? null } : null
+}
+
+function feedbackOptions(config) {
+  return {
+    enabled: valueOf(config, 'feedbackLearningEnabled', true) !== false,
+    halfLifeDays: valueOf(config, 'feedbackHalfLifeDays', 30),
+    priorWeight: valueOf(config, 'feedbackPriorWeight', 3),
+    maxAdjustment: valueOf(config, 'feedbackMaxAdjustment', 0.04),
+    resetAt: valueOf(config, 'feedbackResetAt', 0),
+  }
+}
+
+function dynamicOptions(config) {
+  return {
+    enabled: valueOf(config, 'dynamicDataEnabled', false) === true,
+    liveBenchEndpoint: valueOf(config, 'liveBenchEndpoint', 'https://livebench.ai'),
+    pricingSnapshotEndpoint: valueOf(config, 'pricingSnapshotEndpoint', ''),
+    ttlMs: boundedInteger(valueOf(config, 'dynamicDataTtlMinutes', 1440), 1440, 1, 10_080) * 60_000,
+  }
+}
+
+let dynamicRefresher = null
+async function routingSavedState(config) {
+  const options = dynamicOptions(config)
+  let refreshedData = null
+  if (options.enabled) {
+    dynamicRefresher ??= createDynamicDataRefresher({ store: routerStateStore() })
+    // A public-data failure must never turn into a paid probe or prevent
+    // ordinary routing. The refresher preserves last-good snapshots.
+    try { refreshedData = await dynamicRefresher.refresh(options) } catch { /* state/read errors use the normal fallback */ }
+  }
+  const saved = await savedState()
+  // Config can change while a public request is in flight. Reproject against
+  // the current settings, not the options captured before awaiting refresh.
+  // Cached source A must not masquerade as a newly configured source B.
+  saved.dynamicData = projectDynamicData(refreshedData ?? saved.dynamicData, dynamicOptions(config))
+  saved.routingLearning = buildFeedbackProfile(saved.runs, feedbackOptions(config))
+  return saved
 }
 
-/** Routes with user profiles and the gentle quality bias learned from ratings and reviews. */
-async function routesWithLearning(ctx, config, signal, runs) {
+function planDataOptions(saved, config) {
+  return {
+    ...routingData(saved.dynamicData, dynamicOptions(config).enabled),
+    learning: saved.routingLearning ?? buildFeedbackProfile(saved.runs, feedbackOptions(config)),
+  }
+}
+
+/** Manual exact-route profiles take precedence over public price snapshots.
+ * Only explicit subjective feedback affects utility; reviews stay separate. */
+async function routesWithLearning(ctx, config, signal, runs, dynamicData = null, feedbackProfile = null) {
   const discovered = await discoverConfiguredRoutes(ctx, signal)
-  return applyQualityBiases(configuredRoutesWithProfiles(discovered, config), routeQualityBiases(runs))
+  const profiled = configuredRoutesWithProfiles(discovered, config)
+  const priced = applyPricingSnapshot(profiled, dynamicOptions(config).enabled ? dynamicData?.pricing : null)
+  return applyFeedbackProfile(priced, feedbackProfile ?? buildFeedbackProfile(runs, feedbackOptions(config)))
 }
 
 /** Produce a route recommendation and work packages compatible with official Agent Teams. */
@@ -366,9 +436,9 @@ export async function createRoutePlan(ctx, task, config = {}, options = {}) {
   const mode = options.mode === 'team' ? 'team' : 'single'
   const configuredBudget = valueOf(config, 'budgetUsd', DEFAULT_ROUTER_SETTINGS.budgetUsd)
   const budgetUsd = Math.max(0, finiteNumber(options.budgetUsd, finiteNumber(configuredBudget, 0)))
-  const saved = await savedState()
+  const saved = await routingSavedState(config)
   const [availableRoutes, installed] = await Promise.all([
-    routesWithLearning(ctx, config, options.signal, saved.runs),
+    routesWithLearning(ctx, config, options.signal, saved.runs, saved.dynamicData, saved.routingLearning),
     options.skipToolProbe === true
       ? Promise.resolve(Array.isArray(options.installedToolIds) ? options.installedToolIds : [])
       : installedToolIds(),
@@ -381,6 +451,7 @@ export async function createRoutePlan(ctx, task, config = {}, options = {}) {
     ? (Array.isArray(options.loggedOutToolIds) ? options.loggedOutToolIds : [])
     : loggedOutIds(await currentHealth())
   const plan = createPlanFromRoutes(taskText, availableRoutes, {
+    ...planDataOptions(saved, config),
     mode, budgetUsd, installedToolIds: installed,
     runnableToolIds: installed.filter(id => executable.has(id)),
     preset: routingPresetOf(config, options.preset),
@@ -599,8 +670,8 @@ export async function planAssignment(ctx, task, config = {}, options = {}) {
   if (problem) throw new Error(problem)
   const direct = text(options.provider) || text(options.model)
   if (direct && (!text(options.provider) || !text(options.model))) throw new Error('指定模型需要同时提供 provider 和 model。')
-  const saved = await savedState()
-  const routes = await routesWithLearning(ctx, config, options.signal, saved.runs)
+  const saved = await routingSavedState(config)
+  const routes = await routesWithLearning(ctx, config, options.signal, saved.runs, saved.dynamicData, saved.routingLearning)
   if (direct && !routes.some(route => route.provider === text(options.provider) && route.model === text(options.model))) {
     throw new Error(`模型 ${text(options.provider)}/${text(options.model)} 不在 Harness 模型目录中；请在模型页添加后重试，或改用自动路由。`)
   }
@@ -618,10 +689,12 @@ export async function planAssignment(ctx, task, config = {}, options = {}) {
   const preset = routingPresetOf(config, options.preset)
   const planWith = (presetId, budgetUsd) => direct
     ? createPlanFromRoutes(taskText, routes, {
+      ...planDataOptions(saved, config),
       mode: 'direct', directProvider: options.provider, directModel: options.model,
       installedToolIds: installed, runnableToolIds, preset: presetId, loggedOutToolIds: loggedOut,
     })
     : createPlanFromRoutes(taskText, routes, {
+      ...planDataOptions(saved, config),
       mode: options.planMode === 'team' ? 'team' : 'single',
       budgetUsd, installedToolIds: installed, runnableToolIds, preset: presetId, loggedOutToolIds: loggedOut,
     })
@@ -741,7 +814,8 @@ export async function rerunRecordedStep(ctx, config = {}, { runId, packageId, pr
   if (choice && !['api', 'subscription', 'cancel'].includes(choice)) throw new Error('subscriptionChoice 只能是 api、subscription 或 cancel')
   if (choice && !target.paused) throw new Error('该步骤没有在等待订阅失败的确认；直接重跑即可。')
   if (choice === 'cancel') return { run: await cancelPausedStep(run.id, target.id), execution: null, budget: null, cancelled: true }
-  const routes = await routesWithLearning(ctx, config, signal, saved.runs)
+  const refreshed = await routingSavedState(config)
+  const routes = await routesWithLearning(ctx, config, signal, refreshed.runs, refreshed.dynamicData, refreshed.routingLearning)
   let override = null
   if (text(provider) || text(model)) {
     if (!text(provider) || !text(model)) throw new Error('改派需要同时提供 provider 和 model')
@@ -954,7 +1028,8 @@ export async function planToolRun(ctx, config, args = {}, { signal } = {}) {
   if (text(args.provider) || text(args.model)) {
     if (!text(args.provider) || !text(args.model)) throw new Error('provider 和 model 必须同时提供')
     if (toolForProvider(args.provider)?.id !== toolId) throw new Error('所选模型供应商与官方 CLI 工具不匹配')
-    routes = configuredRoutesWithProfiles(await discoverConfiguredRoutes(ctx, signal), config)
+    const refreshed = await routingSavedState(config)
+    routes = await routesWithLearning(ctx, config, signal, refreshed.runs, refreshed.dynamicData, refreshed.routingLearning)
     route = routes.find(item => item.provider === text(args.provider) && item.model === text(args.model)) ?? null
     if (!route) throw new Error('所选 provider/model 不在官方模型目录中')
     modelId = route.cliModel && toolId !== 'zcode'
@@ -1000,30 +1075,50 @@ export async function recordToolRun({ toolId, task, provider, model, cliModel =
 }
 
 /** Store a user rating (+1 useful, -1 not useful, 0 clears) for one result. */
-export async function rateRecordedResult({ runId, packageId, rating } = {}) {
+export async function rateRecordedResult({ runId, packageId, rating, expectedFinishedAt } = {}, { origin = 'local-explicit-input' } = {}) {
   const value = rating === 'up' || rating === 1 ? 1 : rating === 'down' || rating === -1 ? -1 : rating === 'clear' || rating === 0 ? null : undefined
   if (value === undefined) throw new Error('rating 只能是 up、down 或 clear')
   return routerStateStore().updateRun(text(runId), current => {
     const item = current.packages.find(entry => entry.id === text(packageId))
     if (!item) throw new Error(`运行记录中没有工作包 ${text(packageId)}`)
+    if (expectedFinishedAt !== undefined && (!Number.isFinite(expectedFinishedAt) || expectedFinishedAt !== item.finishedAt)) {
+      throw new Error('结果已更新，请刷新执行记录后再评价。')
+    }
+    if (value !== null && (item.ran !== true || item.ok !== true || item.paused || item.waiting || item.blocked)) {
+      throw new Error('只能评价已成功执行的结果；失败和暂停不自动视为不满意。')
+    }
     item.rating = value
+    item.ratedAt = Date.now()
+    item.feedbackPolicyVersion = 'subjective-utility-v1'
+    item.feedbackOrigin = ['desktop-ui', 'approved-tool'].includes(origin) ? origin : 'local-explicit-input'
   })
 }
 
 /** Everything the workbench shows: recent runs, spending, budget, learned biases and settings. */
 export async function ledgerSummary(config = {}, { limit = 30 } = {}) {
-  const saved = await savedState()
+  const saved = await routingSavedState(config)
   const spent = spending(saved.runs, undefined, saved.archivedSpending)
   const settings = budgetSettings(config)
   return {
     runs: saved.runs.slice(-limit).reverse().map(run => ({
       ...run,
-      task: run.task.slice(0, 2_000),
-      packages: run.packages.map(item => ({ ...item, answer: item.answer.slice(0, 1_500) })),
+      task: text(run.task).slice(0, 2_000),
+      packages: (Array.isArray(run.packages) ? run.packages : []).filter(item => item && typeof item === 'object')
+        .map(item => ({ ...item, answer: text(item.answer).slice(0, 1_500) })),
     })),
     spent,
-    budget: { ...settings, ...budgetCheck({ estimateUsd: null, spent, ...settings }) },
-    biases: routeQualityBiases(saved.runs),
+    budget: { ...settings, ...budgetCheck({ estimateUsd: null, spent, ...settings }), historyVerified: saved.historyVerified !== false },
+    storageAvailable: saved.storageAvailable !== false,
+    storageNotice: saved.storageAvailable === false ? '执行记录存储暂不可用；下方费用与学习摘要尚未核验，不能当作零花费或没有反馈。'
+      : saved.historyVerified === false ? '此前执行记录已损坏或不完整，当前摘要只包含可读记录；不能视为完整费用历史，请从备份恢复后再核验预算。' : '',
+    // Legacy scalar quality biases are intentionally no longer learned.
+    biases: {},
+    learning: saved.routingLearning,
+    dynamicData: dynamicDataSummary(saved.dynamicData, { ...dynamicOptions(config), now: Date.now() }),
+    routingData: {
+      ...routingData(saved.dynamicData, dynamicOptions(config).enabled),
+      pricingSnapshot: dynamicOptions(config).enabled ? saved.dynamicData?.pricing ?? null : null,
+    },
     onboarding: saved.onboarding,
     settings: {
       preset: routingPresetOf(config),
@@ -1308,7 +1403,7 @@ export function routerRemoteServices(ctx, config, { terminals = null } = {}) {
     },
     completeOnboarding: async () => routerStateStore().completeOnboarding(Date.now()),
     ledger: () => ledgerSummary(config),
-    rate: request => rateRecordedResult(request),
+    rate: request => rateRecordedResult(request, { origin: 'desktop-ui' }),
     rerun: request => rerunRecordedStep(ctx, config, {
       runId: request?.runId, packageId: request?.packageId, provider: request?.provider, model: request?.model,
       confirmOverBudget: request?.confirmOverBudget === true, confirmWrite: request?.confirmWrite === true,
@@ -1337,6 +1432,10 @@ export function apply(ctx, config = {}) {
   ctx.on('tools/pre-execute', async (exec, next) => {
     const decision = await next()
     if (decision.kind !== 'allow') return decision
+    if (exec.name === 'model_router_rate') {
+      return { kind: 'ask', reason: 'Confirm the user\'s subjective rating; agents must not self-rate their results',
+        displayReason: { en: 'Save this as your rating and adjust future recommendations?', zh: '确认这是你对该结果的评价，并用于调整以后的推荐？Agent 不能代替你给自己评分。' } }
+    }
     if (exec.name === 'model_router_tool_install') {
       const requested = getOfficialTool(text(exec.arguments?.tool))
       const label = requested?.label ?? '官方 CLI'
@@ -1645,15 +1744,16 @@ function registerOfficialToolModels(ctx, config) {
   }))
   ctx.tools.register(defineTool({
     name: 'model_router_rate',
-    description: 'Record the user\'s rating of one recorded result (up = useful, down = not useful, clear). Ratings gently adjust future routing for that exact provider/model.',
+    description: 'Record only the user\'s explicitly stated rating of one recorded result (up, down, clear). Requires approval; never self-rate. Feedback adjusts bounded local subjective utility, not objective quality.',
     parameters: {
       runId: { type: 'string', required: true, description: 'runId returned by model_router_execute.' },
       packageId: { type: 'string', required: true, description: 'Work package id.' },
       rating: { type: 'string', required: true, enum: ['up', 'down', 'clear'], description: 'The user\'s rating.' },
+      expectedFinishedAt: { type: 'number', description: 'Completion timestamp of the displayed result; rejects stale feedback after a rerun.' },
     },
     output: JSON_OUTPUT,
     async execute(args) {
-      const run = await rateRecordedResult(args)
+      const run = await rateRecordedResult(args, { origin: 'approved-tool' })
       return jsonValue({ ok: true, runId: run.id, packageId: args.packageId, rating: args.rating })
     },
   }))
@@ -1672,8 +1772,8 @@ function registerOfficialToolModels(ctx, config) {
       const { cwd, root, sandboxMode } = await sessionWorkspace(ctx, exec)
       const mode = args.mode === 'workspace-write' ? 'workspace-write' : 'read-only'
       if (mode === 'workspace-write' && sandboxMode === 'read-only') throw new Error('当前 Harness 会话为只读模式，不能请求可编辑团队执行')
-      const [discoveredRoutes, installed] = await Promise.all([discoverConfiguredRoutes(ctx, exec.signal), installedToolIds()])
-      const routes = configuredRoutesWithProfiles(discoveredRoutes, config)
+      const saved = await routingSavedState(config)
+      const [routes, installed] = await Promise.all([routesWithLearning(ctx, config, exec.signal, saved.runs, saved.dynamicData, saved.routingLearning), installedToolIds()])
       const readiness = await Promise.all(installed.map(id => officialToolReadiness(id, cwd)))
       const supported = new Set(readiness.filter(item => item.ready).map(item => item.id))
       const capabilities = new Map(officialToolExecutionCapabilities().map(item => [item.id, item]))
@@ -1688,6 +1788,7 @@ function registerOfficialToolModels(ctx, config) {
       const configuredBudget = valueOf(config, 'budgetUsd', DEFAULT_ROUTER_SETTINGS.budgetUsd)
       const budgetUsd = Math.max(0, finiteNumber(args.budgetUsd, finiteNumber(configuredBudget, 0)))
       const plan = createPlanFromRoutes(args.task, executableRoutes, {
+        ...planDataOptions(saved, config),
         mode: 'team', budgetUsd, installedToolIds: installed,
         runnableToolIds: installed.filter(id => supported.has(id)),
         preset: routingPresetOf(config),

package/.dsh-plugin/shared/adaptive-feedback.mjs

@@ -0,0 +1,272 @@
+/**
+ * Bounded, local subjective-utility personalization. This is not a learned
+ * answer-correctness probability, a bandit policy, or an unbiased evaluation.
+ * Only explicit human feedback on an executed, successful result is evidence.
+ * Model reviews and missing feedback are deliberately not user satisfaction.
+ */
+export const FEEDBACK_POLICY_VERSION = 'subjective-utility-v1'
+export const FEEDBACK_RUN_WINDOW = 200
+/** Cache invalidation cadence; weights themselves still use exact evaluatedAt. */
+export const FEEDBACK_DECAY_REFRESH_MS = 3_600_000
+
+const DAY_MS = 86_400_000
+const finite = value => typeof value === 'number' && Number.isFinite(value)
+const clean = value => typeof value === 'string' ? value.trim() : ''
+const routeKey = (provider, model) => `${provider}\u0000${model}`
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+const own = (value, key) => record(value) && Object.hasOwn(value, key) ? value[key] : undefined
+// Code-unit ordering avoids machine/browser locale changing cache identity.
+const compare = (left, right) => left === right ? 0 : left < right ? -1 : 1
+
+function boundedOption(options, key, fallback, minimum, maximum = Infinity) {
+  const value = options[key] === undefined ? fallback : options[key]
+  if (!finite(value) || value < minimum || value > maximum) {
+    throw new RangeError(`${key} must be a finite number in [${minimum}, ${maximum}]`)
+  }
+  return value
+}
+
+function normalizedOptions(options) {
+  if (!options || typeof options !== 'object' || Array.isArray(options)) throw new TypeError('options must be an object')
+  const enabled = options.enabled === undefined ? true : options.enabled
+  if (typeof enabled !== 'boolean') throw new TypeError('enabled must be boolean')
+  return {
+    enabled,
+    now: boundedOption(options, 'now', Date.now(), 0),
+    halfLifeDays: boundedOption(options, 'halfLifeDays', 30, 1, 3650),
+    priorWeight: boundedOption(options, 'priorWeight', 3, 1, 1_000_000),
+    maxAdjustment: boundedOption(options, 'maxAdjustment', 0.04, 0, 0.1),
+    resetAt: boundedOption(options, 'resetAt', 0, 0),
+  }
+}
+
+/** FNV-1a over JS UTF-16 code units: a short cache identity, NOT a security hash. */
+function cacheRevision(value) {
+  const serialized = JSON.stringify(value)
+  let hash = 0x811c9dc5
+  for (let index = 0; index < serialized.length; index += 1) {
+    hash = Math.imul(hash ^ serialized.charCodeAt(index), 0x01000193) >>> 0
+  }
+  return `${FEEDBACK_POLICY_VERSION}:${hash.toString(16).padStart(8, '0')}`
+}
+
+function completedAt(run, item) {
+  // Stored packages have their own completion time. A historical run may have
+  // only a run-level completion timestamp, then its creation timestamp.
+  // Invalid explicitly supplied timestamps are not repaired by a fallback.
+  for (const candidate of [own(item, 'finishedAt'), own(run, 'finishedAt'), own(run, 'createdAt')]) {
+    if (candidate === undefined || candidate === null) continue
+    return finite(candidate) && candidate >= 0 ? candidate : null
+  }
+  return null
+}
+
+function evidenceOf(run, item, options) {
+  const reject = reason => ({ event: null, reason })
+  const provider = clean(own(item, 'provider'))
+  const model = clean(own(item, 'model'))
+  if (!provider || !model || provider.includes('\u0000') || model.includes('\u0000')) return reject('invalid-route')
+  if (own(item, 'ran') !== true || own(item, 'ok') !== true
+    || item.blocked === true || item.waiting === true || item.paused === true
+    || item.cancelled === true || (item.status !== undefined && !['succeeded', 'fallback'].includes(item.status))) return reject('not-successful')
+  const rating = own(item, 'rating')
+  if (rating !== 1 && rating !== -1) return reject(rating === undefined || rating === null || rating === 0 ? 'unrated' : 'invalid-rating')
+  // A CLI default or a different actual model must not train the recommended
+  // model. Aliases are not silently equated; a future verified adapter may do so.
+  if (item.channel === 'official-cli' && clean(own(item, 'actualModel')) !== model) return reject('cli-model-unverified')
+  const finishedAt = completedAt(run, item)
+  if (finishedAt === null) return reject('invalid-time')
+  if (finishedAt > options.now) return reject('future-time')
+  if (finishedAt <= options.resetAt) return reject('before-reset')
+  const suppliedRatedAt = own(item, 'ratedAt')
+  if (suppliedRatedAt !== undefined && suppliedRatedAt !== null) {
+    if (!finite(suppliedRatedAt) || suppliedRatedAt < finishedAt) return reject('invalid-time')
+    if (suppliedRatedAt > options.now) return reject('future-time')
+  }
+  return { reason: null, event: {
+    runId: own(run, 'id'),
+    packageId: own(item, 'id'),
+    provider,
+    model,
+    domain: clean(own(item, 'type')) || 'general',
+    rating,
+    finishedAt,
+    ratedAt: suppliedRatedAt ?? finishedAt,
+  } }
+}
+
+/**
+ * Build a pure profile from the newest 200 runs under one local DSH home.
+ * Last occurrence of the same run/package replaces earlier occurrences BEFORE
+ * validation: a clear, retry, or invalid latest result removes old evidence.
+ * Existing metadata without ran/ok/identifiers/timestamps is not guessed.
+ *
+ * In one exact provider/model/domain cell:
+ *   w_i = 2 ** (-(now - completedAt_i) / halfLifeMs)
+ *   bias = maxAdjustment * sum(w_i * rating_i) / (priorWeight + sum(w_i))
+ * Ratings are revised in place, never extra independent observations. Decay
+ * uses result completion, so re-rating an old result cannot refresh its age or
+ * bypass resetAt. No cross-domain/model-version/user backoff is performed.
+ */
+export function buildFeedbackProfile(runs, options = {}) {
+  const settings = normalizedOptions(options)
+  const profile = {
+    enabled: settings.enabled,
+    scope: 'local-dsh-home',
+    policyVersion: FEEDBACK_POLICY_VERSION,
+    feedbackCount: 0,
+    ignoredCount: 0,
+    effectiveWeight: 0,
+    updatedAt: null,
+    halfLifeDays: settings.halfLifeDays,
+    priorWeight: settings.priorWeight,
+    maxAdjustment: settings.maxAdjustment,
+    resetAt: settings.resetAt,
+    window: 'last-200-runs',
+    adjustments: {},
+    cellStats: {},
+    exclusionReasons: {},
+    evaluatedAt: settings.now,
+    decayRefreshMs: FEEDBACK_DECAY_REFRESH_MS,
+    decayEpoch: null,
+    evidenceRevision: '',
+    revisionSemantics: 'evidence-settings-and-hourly-decay-cache-identity-not-security-hash',
+    revision: '',
+  }
+  const exclude = reason => {
+    profile.ignoredCount += 1
+    profile.exclusionReasons[reason] = (profile.exclusionReasons[reason] ?? 0) + 1
+  }
+  const latest = new Map()
+  if (settings.enabled) {
+    for (const run of (Array.isArray(runs) ? runs : []).slice(-FEEDBACK_RUN_WINDOW)) {
+      if (!record(run) || (run.packages !== undefined && !Array.isArray(own(run, 'packages')))) {
+        exclude('invalid-record')
+        continue
+      }
+      for (const item of Array.isArray(own(run, 'packages')) ? run.packages : []) {
+        if (!record(item)) {
+          exclude('invalid-record')
+          continue
+        }
+        if (!clean(own(run, 'id')) || !clean(own(item, 'id'))) {
+          exclude('missing-identity')
+          continue
+        }
+        const identity = JSON.stringify([run.id, item.id])
+        if (latest.has(identity)) exclude('superseded')
+        latest.set(identity, { run, item })
+      }
+    }
+  }
+  const events = []
+  for (const { run, item } of latest.values()) {
+    const result = evidenceOf(run, item, settings)
+    if (result.event) events.push(result.event)
+    else exclude(result.reason)
+  }
+  events.sort((left, right) => compare(JSON.stringify([left.runId, left.packageId]), JSON.stringify([right.runId, right.packageId])))
+  const cells = new Map()
+  for (const event of events) {
+    const weight = 2 ** (-(settings.now - event.finishedAt) / (settings.halfLifeDays * DAY_MS))
+    const key = routeKey(event.provider, event.model)
+    const domains = cells.get(key) ?? new Map()
+    const cell = domains.get(event.domain) ?? { sum: 0, weight: 0, count: 0, positive: 0, negative: 0,
+      weightSquaredSum: 0, maxWeight: 0, scaledWeightSum: 0, scaledWeightSquares: 0 }
+    cell.sum += weight * event.rating
+    cell.weight += weight
+    cell.count += 1
+    if (event.rating === 1) cell.positive += 1
+    else cell.negative += 1
+    cell.weightSquaredSum += weight * weight
+    // Rescaling prevents old tiny weights squared from underflowing Kish ESS.
+    if (weight > cell.maxWeight) {
+      const scale = cell.maxWeight / weight
+      cell.scaledWeightSum = cell.scaledWeightSum * scale + 1
+      cell.scaledWeightSquares = cell.scaledWeightSquares * scale * scale + 1
+      cell.maxWeight = weight
+    } else if (weight > 0) {
+      const scaled = weight / cell.maxWeight
+      cell.scaledWeightSum += scaled
+      cell.scaledWeightSquares += scaled * scaled
+    }
+    domains.set(event.domain, cell)
+    cells.set(key, domains)
+    profile.feedbackCount += 1
+    profile.effectiveWeight += weight
+    profile.updatedAt = Math.max(profile.updatedAt ?? 0, event.ratedAt)
+  }
+  // Object.fromEntries safely creates own keys even for opaque identifiers
+  // such as '__proto__'; no task text or answer is copied into this profile.
+  const sortedCells = [...cells.entries()].sort(([left], [right]) => compare(left, right))
+    .map(([key, domains]) => [key, [...domains.entries()].sort(([left], [right]) => compare(left, right))])
+  const adjustment = cell => Math.max(-settings.maxAdjustment, Math.min(settings.maxAdjustment,
+    settings.maxAdjustment * cell.sum / (settings.priorWeight + cell.weight)))
+  profile.adjustments = Object.fromEntries(sortedCells.map(([key, domains]) => [key,
+    Object.fromEntries(domains.map(([domain, cell]) => [domain, adjustment(cell)]))]))
+  profile.cellStats = Object.fromEntries(sortedCells.map(([key, domains]) => [key,
+    Object.fromEntries(domains.map(([domain, cell]) => [domain, {
+      feedbackCount: cell.count, positiveCount: cell.positive, negativeCount: cell.negative,
+      weightedRatingSum: cell.sum, effectiveWeight: cell.weight, weightSquaredSum: cell.weightSquaredSum,
+      // Keep machine output within the mathematical bound despite ULP rounding.
+      effectiveSampleSize: cell.scaledWeightSquares > 0
+        ? Math.min(cell.count, Math.max(0, cell.scaledWeightSum ** 2 / cell.scaledWeightSquares)) : 0,
+      shrinkage: cell.weight / (settings.priorWeight + cell.weight), adjustment: adjustment(cell),
+      semantics: 'observed-feedback-weight-diagnostics-not-confidence-or-correctness',
+    }]))]))
+  const { now: evaluatedAt, ...evidenceSettings } = settings
+  const identityEvents = events.map(({ ratedAt, ...event }) => event)
+  profile.evidenceRevision = cacheRevision({ settings: evidenceSettings, events: identityEvents })
+  profile.decayEpoch = events.length > 0 && settings.maxAdjustment > 0
+    ? Math.floor(evaluatedAt / FEEDBACK_DECAY_REFRESH_MS) : null
+  // A decision cache identity, intentionally not the hash of every continuously
+  // changing weight. Empty evidence and audit-only re-rating do not erase plans;
+  // active preferences invalidate once/hour so long-term decay keeps updating.
+  profile.revision = cacheRevision({ evidenceRevision: profile.evidenceRevision, decayEpoch: profile.decayEpoch })
+  return profile
+}
+
+/**
+ * Add separate preference metadata; never overwrite benchmark quality/source.
+ * Unknown/catalog quality remains unknown/catalog evidence after applying this
+ * profile. The planner must consume the domain-specific adjustment explicitly.
+ */
+export function applyFeedbackProfile(routes, profile) {
+  if (!Array.isArray(routes) || !record(profile) || typeof profile.enabled !== 'boolean') return routes
+  return routes.map(route => {
+    if (!record(route)) return route
+    let base = route
+    if (Object.hasOwn(route, 'preferenceAdjustments') || Object.hasOwn(route, 'preferenceAdjustmentMeta')) {
+      base = { ...route }
+      delete base.preferenceAdjustments
+      delete base.preferenceAdjustmentMeta
+    }
+    if (profile.enabled !== true || !record(profile.adjustments)) return base
+    const key = routeKey(clean(route.provider), clean(route.model))
+    if (!Object.hasOwn(profile.adjustments, key)) return base
+    const value = profile.adjustments[key]
+    if (!record(value)) return base
+    const limit = finite(profile.maxAdjustment) && profile.maxAdjustment >= 0 && profile.maxAdjustment <= 0.1 ? profile.maxAdjustment : 0.1
+    const adjustments = Object.fromEntries(Object.entries(value).filter(([, bias]) => finite(bias) && Math.abs(bias) <= limit))
+    if (!Object.keys(adjustments).length) return base
+    return {
+      ...base,
+      preferenceAdjustments: adjustments,
+      preferenceAdjustmentMeta: {
+        policyVersion: profile.policyVersion,
+        revision: profile.revision,
+        scope: profile.scope,
+        feedbackCount: profile.feedbackCount,
+        effectiveWeight: profile.effectiveWeight,
+        updatedAt: profile.updatedAt,
+        halfLifeDays: profile.halfLifeDays,
+        maxAdjustment: profile.maxAdjustment,
+        window: profile.window,
+        cellStats: Object.hasOwn(profile.cellStats ?? {}, key) ? profile.cellStats[key] : {},
+        evaluatedAt: profile.evaluatedAt,
+        decayRefreshMs: profile.decayRefreshMs,
+        revisionSemantics: profile.revisionSemantics,
+      },
+    }
+  })
+}

package/.dsh-plugin/shared/assignment-solver.mjs

@@ -0,0 +1,86 @@
+/**
+ * Deterministic budget-constrained DAG assignment, independent of model names.
+ * Exact enumeration is bounded by the retained Cartesian candidate space;
+ * larger spaces use a beam with a protected least-cost feasible prefix.
+ * Optimality concerns this surrogate objective, never actual answer quality.
+ */
+const EPSILON = 1e-12
+const compareText = (a, b) => a < b ? -1 : a > b ? 1 : 0
+const signature = state => JSON.stringify(state.choices.map(option => option.route))
+
+function compareStates(left, right, minimizeCost = false) {
+  return left.relaxedCount - right.relaxedCount
+    || left.qualityShortfall - right.qualityShortfall
+    || (minimizeCost ? left.cost - right.cost : right.score - left.score)
+    || (minimizeCost ? right.score - left.score : left.cost - right.cost)
+    || left.switches - right.switches
+    || compareText(signature(left), signature(right))
+}
+
+export function solveCandidateAssignments({ tasks = [], pools = [], budget = Infinity, beamWidth = 256, exactLimit = 4096, handoffPenalty = 0.015, minimizeCost = false } = {}) {
+  if (!tasks.length || tasks.length !== pools.length) return null
+  const preceding = new Set()
+  for (const task of tasks) {
+    if (!task.id || preceding.has(task.id) || (task.dependsOn ?? []).some(id => !preceding.has(id))) {
+      throw new RangeError('Assignment tasks must have unique ids and known dependencies in topological order')
+    }
+    preceding.add(task.id)
+  }
+  const constrained = Number.isFinite(budget)
+  const options = pools.map(pool => (Array.isArray(pool) ? pool : []).filter(option =>
+    Number.isFinite(option.cost) && option.cost >= 0 && Number.isFinite(option.score)
+    && (!constrained || option.pricingKnown === true)))
+  if (options.some(pool => pool.length === 0)) return null
+  const suffixMinimum = Array(tasks.length + 1).fill(0)
+  let searchSpace = 1
+  let searchSpaceCapped = false
+  for (let index = tasks.length - 1; index >= 0; index--) {
+    suffixMinimum[index] = suffixMinimum[index + 1] + Math.min(...options[index].map(option => option.cost))
+    const product = searchSpace * options[index].length
+    if (product > Number.MAX_SAFE_INTEGER) searchSpaceCapped = true
+    searchSpace = Math.min(Number.MAX_SAFE_INTEGER, product)
+  }
+  if (constrained && suffixMinimum[0] > budget + EPSILON) return null
+  const exact = !searchSpaceCapped && searchSpace <= Math.max(1, exactLimit)
+  const width = Math.max(1, Math.floor(beamWidth) || 256)
+  const search = { method: exact ? 'exact' : 'beam', exact, searchSpace, searchSpaceCapped, expandedStates: 0, beamPruned: 0 }
+  let states = [{ choices: [], routesByTask: new Map(), score: 0, cost: 0, switches: 0, relaxedCount: 0, qualityShortfall: 0 }]
+  for (let index = 0; index < tasks.length; index++) {
+    const task = tasks[index]
+    const expanded = []
+    for (const state of states) {
+      for (const option of options[index]) {
+        const cost = state.cost + option.cost
+        if (constrained && cost + suffixMinimum[index + 1] > budget + EPSILON) continue
+        const switches = (task.dependsOn ?? []).reduce((count, dependency) => {
+          const route = state.routesByTask.get(dependency)
+          return count + (route !== undefined && route !== option.route ? 1 : 0)
+        }, 0)
+        const penalty = switches * handoffPenalty
+        const shortfall = Math.max(0, Number(option.qualityShortfall) || 0)
+        const routesByTask = new Map(state.routesByTask)
+        routesByTask.set(task.id, option.route)
+        expanded.push({ choices: [...state.choices, { ...option, handoffPenalty: penalty }], routesByTask,
+          score: state.score + option.score - penalty, cost, switches: state.switches + switches,
+          relaxedCount: state.relaxedCount + (shortfall > 0 ? 1 : 0), qualityShortfall: state.qualityShortfall + shortfall })
+        search.expandedStates++
+      }
+    }
+    if (!expanded.length) return null
+    expanded.sort((left, right) => compareStates(left, right, minimizeCost))
+    if (!exact && expanded.length > width) {
+      // A high-utility prefix must not crowd out every affordable completion.
+      // This also works at width=1; quality relaxation remains lexicographic.
+      states = expanded.slice(0, width)
+      if (constrained && index < tasks.length - 1) {
+        const cheapest = expanded.reduce((best, state) => compareStates(state, best, true) < 0 ? state : best)
+        if (!states.includes(cheapest)) states[width - 1] = cheapest
+      }
+      search.beamPruned += expanded.length - states.length
+    } else states = expanded
+  }
+  states.sort((left, right) => compareStates(left, right, minimizeCost))
+  const best = states[0]
+  const { routesByTask, ...result } = best
+  return { ...result, minimumCostLowerBound: suffixMinimum[0], search }
+}