@miller-tech/uap 1.163.13 → 1.165.0

package/dist/cli/deliver.js

@@ -11,13 +11,15 @@ import { existsSync, mkdirSync, openSync, readFileSync, rmSync, writeSync, close
 import { join, resolve, relative } from 'path';
 import { ConvergenceLoop, composeIterationHooks } from '../delivery/convergence-loop.js';
 import { createModelJudge } from '../delivery/judge.js';
+import { resolveJudgePlan, formatVerificationProvenance, } from '../delivery/verification-provenance.js';
 import { createModelCritic } from '../delivery/critic.js';
 import { MAX_CANDIDATES } from '../delivery/explorer.js';
 import { generateStrategySeeds, seedsFromIdeas } from '../delivery/ideation.js';
 import { DEFAULT_STRATEGY_SEEDS } from '../delivery/explorer.js';
 import { planAutoOptimization } from '../delivery/auto-optimizer.js';
-import { RoutingPresets, resolvePresetModel } from '../models/types.js';
-import { measureQueryComplexity } from '../utils/query-complexity.js';
+import { RoutingPresets, resolvePresetModel, resolvePhaseChain } from '../models/types.js';
+import { classifyComplexity, tierToRouting } from '../models/complexity.js';
+import { promptSelectionFromConfig } from '../self-tuning/prompt-variants.js';
 import { authorAcceptanceGate } from '../delivery/self-gate.js';
 import { applyPendingIntents } from '../delivery/pending-intents.js';
 import { runAcceptanceGate } from '../delivery/acceptance-judge.js';
@@ -47,6 +49,36 @@ export function shouldSkipAcceptanceJudge(opts) {
         opts.complexity === 'simple' &&
         !opts.acceptancePrimary);
 }
+/**
+ * When the model fails to author a self-gate, is that fatal?
+ *
+ * Only if the run would then have NO convergence target at all. Getting this
+ * wrong in the permissive direction re-opens the false-green door the
+ * anti-vacuous floor exists to close: with no self-gate rung and no acceptance
+ * judge, a repo whose gates were already green is "delivered" having written
+ * nothing.
+ *
+ * Two traps this predicate exists to avoid, both of which `!options.acceptance`
+ * alone walks straight into:
+ *
+ *  - `--acceptance` is on but the judge is SKIPPED for a simple task
+ *    (shouldSkipAcceptanceJudge), so no gate object is ever built.
+ *  - max fidelity is treated as a standing blocker. It is not: the vision review
+ *    lives INSIDE the acceptance gate, so if that gate was never built there is
+ *    nothing to block, and visionAcceptanceFeedback additionally fails open on
+ *    five separate conditions (no vision model, no screenshots, non-final epic,
+ *    any thrown error, fidelity not max).
+ *
+ * So the only thing that makes a missing self-gate survivable is a judge that
+ * will actually run — plus at least one real rung to converge against.
+ */
+export function selfGateFailureIsFatal(opts) {
+    // A judge that will actually run is the only substitute. Surviving rungs do not
+    // rescue this: needsSelfGate is raised precisely when the objective gates are
+    // all GREEN (no convergence pressure) or absent entirely (the loop throws), so
+    // in both cases a missing self-gate with no judge leaves nothing to satisfy.
+    return !(opts.acceptanceEnabled && !opts.judgeSkipped);
+}
 /**
  * Generator≠Evaluator: resolve which model should AUTHOR + JUDGE the acceptance
  * gate. Returns the evaluator preset id when it must differ from the generator
@@ -105,7 +137,7 @@ import { initLedger, markItem } from '../delivery/completion-ledger.js';
 import { loadUapConfigRaw } from '../utils/config-loader.js';
 import { resolveEscalateModelId } from '../delivery/repair-escalation.js';
 import { createUserValidationRunner, resolveUserValidationMode, synthesizeUserValidationRung, } from '../delivery/user-validation.js';
-import { deriveUserPaths, fallbackWebManifest, loadUserPaths, mergeUserPaths, USER_PATHS_FILE } from '../delivery/user-paths.js';
+import { deriveUserPaths, fallbackWebManifest, loadUserPaths, mergeUserPaths, renderAcceptanceContract, USER_PATHS_FILE } from '../delivery/user-paths.js';
 import { detectArtifactType } from '../delivery/execution-gate.js';
 /** Raw .uap.json reader usable before the main cfgRawEarly declaration. */
 function cfgRawEarlyForUvFactory(projectRoot) {
@@ -182,20 +214,14 @@ function fail(message) {
 }
 class ExitError extends Error {
 }
-/** Deliver's 3-level complexity (simple/moderate/complex) → the routing tier
- * scale (low/medium/high/critical). Deliver's classifier never emits
- * 'critical' — that tier is reserved for keyword-driven escalation. */
-const COMPLEXITY_TO_TIER = {
-    simple: 'low',
-    moderate: 'medium',
-    complex: 'high',
-};
 /**
  * Complexity-tier routing (P: per-task model selection). Returns the model id
  * to execute this task on, or null to leave the caller's default untouched.
- * PURE — unit-tested. Precedence is enforced by the caller: an explicit
- * --model always wins; this only fires when routing is requested and no model
- * was pinned.
+ * PURE — unit-tested. Uses the unified complexity classifier (src/models/
+ * complexity.ts) so `critical` is preserved end-to-end — the old
+ * COMPLEXITY_TO_TIER bridge silently dropped it. Precedence is enforced by the
+ * caller: an explicit --model always wins; this only fires when routing is
+ * requested and no model was pinned.
  */
 export function resolveTierModel(routingId, instruction) {
     const id = routingId ?? process.env.UAP_DELIVER_ROUTING;
@@ -204,8 +230,7 @@ export function resolveTierModel(routingId, instruction) {
     const preset = RoutingPresets[id];
     if (!preset)
         return null;
-    const complexity = measureQueryComplexity(instruction, { moderate: 1, complex: 2 });
-    const tier = COMPLEXITY_TO_TIER[complexity] ?? 'medium';
+    const tier = tierToRouting(classifyComplexity({ instruction }).tier);
     return { model: resolvePresetModel(preset, { complexity: tier, role: 'executor' }), tier, preset: id };
 }
 function resolveModel(presetId, endpointOverride) {
@@ -997,8 +1022,52 @@ async function runDeliver(instruction, options) {
     }
     let evaluatorExecutor = blindExecutor;
     let verdictExecutor = jsonBlindExecutor;
-    if (evaluatorPresetId) {
-        const evalModel = resolveModel(evaluatorPresetId, options.evaluatorEndpoint);
+    // Verification provenance (S1 — Principle 3: "the model cannot verify itself").
+    // Deliver must never let the generator be the SOLE grader of its own output.
+    const allowSelfJudge = process.env.UAP_DELIVER_ALLOW_SELF_JUDGE === '1' ||
+        (() => {
+            try {
+                const c = loadUapConfigRaw(projectRoot);
+                return c?.recipes?.allowSelfJudge === true;
+            }
+            catch {
+                return false;
+            }
+        })();
+    // Q3: when a routing preset is active, prefer ITS review-phase model as the
+    // distinct judge (compose S1 verification with the S3 per-phase matrix) instead
+    // of the hardcoded haiku default — the preset's designated reviewer IS the
+    // Generator≠Evaluator choice. resolveJudgePlan still swaps to the alt judge if
+    // this collides with the generator, and only uses it on the auto-distinct path.
+    const routingIdForJudge = options.routing ?? process.env.UAP_DELIVER_ROUTING;
+    const presetForJudge = routingIdForJudge ? RoutingPresets[routingIdForJudge] : undefined;
+    const reviewJudgeId = presetForJudge
+        ? resolvePhaseChain(presetForJudge, {
+            complexity: tierToRouting(classifyComplexity({ instruction }).tier),
+            phase: 'review',
+        })[0]
+        : undefined;
+    const judgePlan = resolveJudgePlan({
+        evaluatorPresetId,
+        generatorId: model.id,
+        generatorProvider: ModelPresets[presetId]?.provider,
+        allowSelfJudge,
+        distinctJudgeId: reviewJudgeId,
+        hasPreset: (id) => Boolean(ModelPresets[id]),
+    });
+    const judgeModelId = judgePlan.judgeModelId;
+    const judgeDistinct = judgePlan.distinct;
+    // Acceptance-scoped executors: they author the self-gate (verify.sh) and run
+    // the acceptance JUDGE. They default to the generator and are the ONLY channels
+    // the auto-distinct judge redirects — PLANNING (planDeliveryPhases /
+    // deriveUserPaths on verdictExecutor) stays on the generator to avoid a
+    // planning-quality regression (review C1).
+    let gateAuthorExecutor = evaluatorExecutor;
+    let acceptanceJudgeExecutor = verdictExecutor;
+    if (judgePlan.reason === 'configured-evaluator') {
+        // A distinct configured evaluator drives the evaluation channel AND planning
+        // (pre-existing barbell behavior): reassign the globals.
+        const evalModel = resolveModel(judgeModelId, options.evaluatorEndpoint);
         const evalClient = new OpenAICompatClient();
         evaluatorExecutor = async (prompt) => {
             // Evaluators judge cool + deterministic; they do not brainstorm.
@@ -1009,10 +1078,28 @@ async function runDeliver(instruction, options) {
             const r = await evalClient.complete(evalModel, prompt, { temperature: 0, jsonResponse: true });
             return r.content;
         };
+        gateAuthorExecutor = evaluatorExecutor;
+        acceptanceJudgeExecutor = verdictExecutor;
         if (!options.dryRun) {
             console.log(chalk.cyan(`⚖ generator≠evaluator: gen=${model.id} eval=${evalModel.id}`));
         }
     }
+    else if (judgePlan.reason === 'auto-distinct-judge') {
+        // No evaluator configured + cloud generator → run the acceptance JUDGE and
+        // self-gate author on a cheap DISTINCT cloud model, WITHOUT hijacking the
+        // planning executors (C1). The generator still plans; it no longer grades
+        // itself.
+        const jModel = resolveModel(judgeModelId);
+        const jClient = new OpenAICompatClient();
+        gateAuthorExecutor = async (prompt) => (await jClient.complete(jModel, prompt, { temperature: 0 })).content;
+        acceptanceJudgeExecutor = async (prompt) => (await jClient.complete(jModel, prompt, { temperature: 0, jsonResponse: true })).content;
+        if (!options.dryRun) {
+            console.log(chalk.cyan(`⚖ generator≠evaluator (auto distinct acceptance judge): gen=${model.id} judge=${jModel.id}`));
+        }
+    }
+    else if (!judgeDistinct && !allowSelfJudge && !options.dryRun) {
+        console.log(chalk.yellow(`⚠ verify: no distinct judge reachable (gen=${model.id} local/offline) — generator grades its own output`));
+    }
     // Dynamic executor selection. The blind executor is one completion per turn
     // (cheap, but cannot inspect or run anything); the agentic executor runs a
     // tool-using loop (read/list/bash/write) and mutates the repo directly. 'auto'
@@ -1142,23 +1229,40 @@ async function runDeliver(instruction, options) {
         console.log(chalk.cyan('⚖ self-gate: authoring a task-specific acceptance check…'));
         // Author the gate with the blind executor — it is a single-shot script
         // write, not a task to solve agentically.
-        const sg = await authorAcceptanceGate({ instruction, projectRoot, executor: evaluatorExecutor });
+        const sg = await authorAcceptanceGate({ instruction, projectRoot, executor: gateAuthorExecutor });
         for (const note of sg.notes)
             console.log(chalk.dim(`    ${note}`));
         if (!sg.rung) {
-            fail('Could not author an acceptance gate (model produced no runnable script).');
-        }
-        rungs.push(sg.rung);
-        if (sg.vacuous) {
-            // P0 hard-fail: a REQUIRED self-gate that passes on the unsolved repo
-            // re-opens the false-green door — "delivered" would be meaningless.
-            if (process.env.UAP_DELIVER_ALLOW_WEAK_SELF_GATE !== '1') {
-                fail('The self-gate is REQUIRED for this run (anti-vacuous floor) but stayed vacuous after retries — it passes on the unsolved repo. Add concrete, checkable ACCEPTANCE CRITERIA to the instruction, or set UAP_DELIVER_ALLOW_WEAK_SELF_GATE=1 to accept the risk.');
+            // A failed self-gate is survivable only when a real acceptance judge will
+            // run and become the convergence target. See selfGateFailureIsFatal — in
+            // particular, max fidelity is NOT a substitute: the vision review lives
+            // inside the acceptance gate, so when that gate is never built there is
+            // nothing for it to block.
+            if (selfGateFailureIsFatal({
+                acceptanceEnabled: Boolean(options.acceptance),
+                judgeSkipped: shouldSkipAcceptanceJudge({
+                    acceptanceEnabled: Boolean(options.acceptance),
+                    complexity: autoPlan?.complexity,
+                    acceptancePrimary,
+                }),
+            })) {
+                fail('Could not author an acceptance gate (model produced no runnable script).');
             }
-            console.log(chalk.yellow('  ⚠ acceptance gate may be weak (could not force an initially-failing check); UAP_DELIVER_ALLOW_WEAK_SELF_GATE=1 — running multi-turn anyway.'));
+            console.log(chalk.yellow('  ⚠ self-gate authoring failed — the acceptance judge is the convergence target for this run.'));
         }
         else {
-            console.log(chalk.green('  ✓ acceptance gate authored — fails on the unsolved repo, a real convergence target.'));
+            rungs.push(sg.rung);
+            if (sg.vacuous) {
+                // P0 hard-fail: a REQUIRED self-gate that passes on the unsolved repo
+                // re-opens the false-green door — "delivered" would be meaningless.
+                if (process.env.UAP_DELIVER_ALLOW_WEAK_SELF_GATE !== '1') {
+                    fail('The self-gate is REQUIRED for this run (anti-vacuous floor) but stayed vacuous after retries — it passes on the unsolved repo. Add concrete, checkable ACCEPTANCE CRITERIA to the instruction, or set UAP_DELIVER_ALLOW_WEAK_SELF_GATE=1 to accept the risk.');
+                }
+                console.log(chalk.yellow('  ⚠ acceptance gate may be weak (could not force an initially-failing check); UAP_DELIVER_ALLOW_WEAK_SELF_GATE=1 — running multi-turn anyway.'));
+            }
+            else {
+                console.log(chalk.green('  ✓ acceptance gate authored — fails on the unsolved repo, a real convergence target.'));
+            }
         }
     }
     // Phase 5: escalation ladder. Cheap strategies first (widen exploration →
@@ -1388,7 +1492,7 @@ async function runDeliver(instruction, options) {
         ? buildMissionAcceptanceGate({
             primary: acceptancePrimary,
             specs,
-            judgeExecutor: verdictExecutor,
+            judgeExecutor: acceptanceJudgeExecutor,
             note: (line) => console.log(chalk.yellow(`  ${line}`)),
         })
         : undefined;
@@ -1464,6 +1568,16 @@ async function runDeliver(instruction, options) {
         projectRoot,
         maxTurns,
         rungs,
+        // MIPRO (S8/3a): feed any tuner-selected prompt-fragment variants from
+        // .uap.json to the prompt builder. Empty/absent → the byte-identical default.
+        promptSelection: (() => {
+            try {
+                return promptSelectionFromConfig((loadUapConfigRaw(projectRoot) ?? {}));
+            }
+            catch {
+                return undefined;
+            }
+        })(),
         // The agentic executor mutates the repo directly (no-op applier), so
         // gates must run every turn regardless of applier file count.
         alwaysVerify: agentic ? true : undefined,
@@ -1663,6 +1777,27 @@ async function runDeliver(instruction, options) {
             console.log(chalk.dim('  user-validation: no manifest derived — gate will report NA until one exists'));
         }
     }
+    // Surface the acceptance contract (the user-path journeys + required selectors)
+    // to the executor on EVERY turn. The manifest is authored up front but was
+    // otherwise invisible to the implementer, so a weak model built artifacts that
+    // the real-client gate could not drive (e.g. a canvas-only UI with no DOM
+    // handles) and then could not self-correct from the gate's selector-not-found
+    // feedback. Injecting the contract closes the author→implement loop: the model
+    // builds a complete, drivable artifact from turn 1. Fail-soft — an aid, never a
+    // blocker.
+    if (userValidationMode !== 'off') {
+        try {
+            const loaded = loadUserPaths(projectRoot);
+            const contract = renderAcceptanceContract(loaded?.manifest ?? null);
+            if (contract) {
+                loopConfig.acceptanceContract = contract;
+                console.log(chalk.dim('  user-validation: acceptance contract (journeys + required selectors) injected into the executor prompt'));
+            }
+        }
+        catch {
+            /* contract injection is a best-effort completeness aid */
+        }
+    }
     const runState = {
         runId,
         instruction,
@@ -1695,6 +1830,12 @@ async function runDeliver(instruction, options) {
         runState.checkpoint = cp;
         saveRunState(runState);
     };
+    // Under max fidelity the vision aesthetic review is a BLOCKING release gate;
+    // let the acceptance gate run (and feed vision findings) even when the ladder
+    // is red on a synthetic anti-vacuous self-gate, so the model gets aesthetic
+    // feedback instead of stalling. The gate re-checks operational + behavioral
+    // itself before grading (mission-acceptance), preserving the required ordering.
+    loopConfig.runAcceptanceDespiteLadder = deliverFidelity.max;
     // Cooperative cancel from the dashboard: the loop polls this each turn.
     loopConfig.shouldStop = () => isStopRequested(projectRoot, runId);
     clearStop(projectRoot, runId);
@@ -2122,7 +2263,18 @@ async function runDeliver(instruction, options) {
     // Regression scoring uses only the fast tier — a cheap, synchronous, always-
     // run signal. Integration/deploy-dev gates may not run at baseline (promotion
     // is cheap-first), so they are not a trustworthy regression comparison.
-    const fastRungs = rungs.filter((r) => tierOf(r) === 'fast');
+    // keep-best scores the DETERMINISTIC objective gates — build/test/lint (fast) PLUS
+    // the execution smoke (runtime) and user-path (final) gates — not just the fast tier.
+    // On a project whose only meaningful gates are runtime/final (e.g. a vanilla-JS web
+    // app with no build step) the fast subset is trivially 1.00 every turn, so
+    // best-intermediate never advanced and a 100%-functional turn that later regressed
+    // was DISCARDED (octopus, 2026-07-24: the lazy turn hit 100% of gates, the
+    // vision-chasing turns then rewrote game.js and broke the HUD wiring, and the win was
+    // lost — the harness kept the regressed end state). Exclude the LLM judge rungs
+    // (bootstrap/acceptance): non-deterministic, they would make the rollback target flap.
+    const KEEP_BEST_TIERS = new Set(['fast', 'runtime', 'integration', 'final']);
+    const KEEP_BEST_EXCLUDE_IDS = new Set(['bootstrap', 'acceptance']);
+    const fastRungs = rungs.filter((r) => KEEP_BEST_TIERS.has(tierOf(r)) && !KEEP_BEST_EXCLUDE_IDS.has(r.id));
     const keepBest = Boolean(options.keepBest) && fastRungs.length > 0 && !needsSelfGate;
     let regressSnapshot = null;
     let baselineGateScore = 0;
@@ -2168,6 +2320,12 @@ async function runDeliver(instruction, options) {
                 redetectRungs: true,
                 redetectFilter: loopConfig.redetectFilter,
                 protectTests: options.protectTests,
+                // The acceptance contract is a REQUIREMENT spec, not a convergence aid:
+                // carry it into the bare turn so a one-shot build already exposes the
+                // journeys/selectors the gate will drive (otherwise the lazy turn builds
+                // blind, e.g. a canvas-only UI with no DOM handles, and only later turns
+                // — which do get the contract — can recover it).
+                acceptanceContract: loopConfig.acceptanceContract,
                 onIteration: (record) => { updateDeliverHeartbeat(projectRoot); printProgress(record); },
             }, executor, seams);
             const lazyResult = await lazyLoop.deliver(instruction);
@@ -2433,6 +2591,15 @@ async function runDeliver(instruction, options) {
     catch {
         // Memory recording is best-effort
     }
+    // Verification provenance banner (S1) — makes the judge boundary observable.
+    if (!options.json && !options.dryRun) {
+        const line = formatVerificationProvenance({
+            executorModel: model.id,
+            judgeModel: judgeModelId,
+            distinct: judgeDistinct,
+        });
+        console.log(judgeDistinct ? chalk.dim(line) : chalk.yellow(line));
+    }
     if (options.json) {
         const { finalOutput, ...rest } = result;
         console.log(JSON.stringify({