@mindot/will 0.7.0 → 0.8.0

package/src/stem/mind.ts

@@ -25,6 +25,7 @@ import { validateWillIdentity }  from '#stem/guards/identity.guard'
 import { OutboxWriter } from '#stem/tracts/outbox.writer'
 import { ExecutiveSummarizer } from '#llm/summarizer'
 import type { LLMProvider } from '#llm/index'
+import { TableRouter, chainRouters, type ModelRouter, type RoutingRule } from '#llm/routing'
 import { resolveProfile } from '#profiles/index'
 import { DefaultVectorMemoryAdapter } from '#memory/vector.adapter'
 import { OpenAICompatibleEmbedder, MockEmbedder } from '#memory/vector.embedder'
@@ -46,6 +47,7 @@ import { effectorName, type EffectorDeclaration } from '#agency/types'
 
 import {
   TokenTracker,
+  type PriceTable,
   EnergyRegulator,
   SleepPressureRegulator,
   CircadianOscillator,
@@ -137,12 +139,54 @@ export interface WillModelConfig {
  * `apiKey` is held in memory only — it is never mirrored into state entities,
  * session logs, or the PMA.
  */
+export interface WillProviderConfig {
+  /** Credential for this provider. Held in memory only — never state/logs/PMA. */
+  apiKey?:  string
+  /** Base URL override — self-hosted or OpenAI-compatible endpoints. */
+  baseUrl?: string
+  /**
+   * USD per 1M tokens, keyed by model id. Host-owned on purpose: prices change
+   * on a vendor's schedule, differ per account, and are ~0 self-hosted, so they
+   * cannot be tracked from inside an npm release. These win over the engine's
+   * built-in fallback table.
+   *
+   * Cost is telemetry only — it never enters simulation state — so changing a
+   * price can never change what a mind does or break a replay.
+   */
+  prices?:  PriceTable
+}
+
 export interface WillLLMConfig {
   provider?:        LLMProvider
   apiKey?:          string
   baseUrl?:         string
   maxOutputTokens?: number
   timeoutMs?:       number
+  /**
+   * Everything the host knows about each provider — credential, endpoint, and
+   * prices — declared once per provider. The single-provider fields above stay
+   * the simple path; this map is for hosts reaching more than one.
+   */
+  providers?:       Partial<Record<LLMProvider, WillProviderConfig>>
+  /**
+   * Per-call model selection. Omitted (or NULL_ROUTER) means every call uses
+   * `model` above, exactly as before the seam existed.
+   *
+   * The router sees only the call's attribution — what kind of work it is and
+   * how much the moment demands — never who is paying or what anything costs.
+   * Routes name providers from the `providers` map above; a route to a provider
+   * with no credential falls back to the default rather than failing the call.
+   */
+  router?:          ModelRouter | null
+  /**
+   * Concrete LLM model id(s) for this Will — a single id for every role, or a
+   * per-role map. An explicit WILL_LLM_MODEL env pins the thinking roles
+   * (operator single-model deployments); unset roles fall back to `executive`,
+   * then the LLMDirector's built-in default. Product-level labels (pricing
+   * tiers, model families) live host-side and resolve to concrete ids BEFORE
+   * reaching the engine.
+   */
+  model?: string | WillModelConfig
 }
 
 /** Executive-side resolved roles (embedding is threaded separately). */
@@ -159,6 +203,91 @@ export interface ExecutiveModelRoles {
  * single-model deployment, full stop. Embedding is untouched by the pin
  * (different model family; the embedding stack has its own env).
  */
+/**
+ * Flatten the per-provider `prices` maps into one model→price table.
+ *
+ * Providers declare their own models, so collisions are not expected; if two
+ * do claim the same id, the first declared wins rather than silently taking
+ * whichever iterated last.
+ */
+export function mergeProviderPrices(
+  providers?: Partial<Record<LLMProvider, WillProviderConfig>>,
+): PriceTable | undefined {
+  if( !providers ) return undefined
+  const out: PriceTable = {}
+  for( const entry of Object.values( providers ) ){
+    for( const [ model, price ] of Object.entries( entry?.prices ?? {} ) ){
+      if( !( model in out ) ) out[ model ] = price
+    }
+  }
+  return Object.keys( out ).length > 0 ? out : undefined
+}
+
+/**
+ * Narrow the per-provider map to just what the LLM transport needs — the
+ * prices ride to the TokenTracker instead, so a credential map never carries
+ * pricing into the call path.
+ */
+export function providerCredentials(
+  providers: Partial<Record<LLMProvider, WillProviderConfig>>,
+): Partial<Record<LLMProvider, { apiKey: string; baseUrl?: string }>> {
+  const out: Partial<Record<LLMProvider, { apiKey: string; baseUrl?: string }>> = {}
+  for( const [ name, entry ] of Object.entries( providers ) ){
+    if( !entry?.apiKey ) continue   // no key ⇒ unusable; the router falls back
+    out[ name as LLMProvider ] = {
+      apiKey: entry.apiKey,
+      ...( entry.baseUrl ? { baseUrl: entry.baseUrl } : {} ),
+    }
+  }
+  return out
+}
+
+/**
+ * Compile the per-role model map into routing rules — MODEL_ROUTING W7.
+ *
+ * The role map and the router were two mechanisms answering one question
+ * ("which model serves this call?"). The map was implemented by giving each
+ * role its own cached `LLMDirector`, which meant role selection happened at
+ * *facet-spawn* time while routing happened at *call* time — two answers, one
+ * question, and a facet could be pinned to a model its work had since stopped
+ * matching. The map is now sugar: it desugars to rules and there is one
+ * mechanism left.
+ *
+ * The mapping is exact, because every role's call sites already tag themselves
+ * with the matching axis:
+ *
+ * | role           | rule                        | call sites                          |
+ * | :---           | :---                        | :---                                |
+ * | `summarizer`   | `category: 'summarizer'`    | the rolling summariser              |
+ * | `deliberation` | `function: 'deliberation'`  | the deliberation facet + its propose pass |
+ * | `conversation` | `function: 'conversation'` and `'outreach'` | the audition facets   |
+ * | `executive`    | — it *is* the default       | master, and every unlabelled facet  |
+ *
+ * Roles equal to `executive` emit no rule: a Will on a single model keeps an
+ * empty chain and stays byte-identical to one built before this seam existed.
+ *
+ * Routes carry no provider — a role has never had one. They inherit the Will's
+ * default provider, which is exactly what the per-role directors did.
+ */
+export function compileRoleRouter( roles: ExecutiveModelRoles ): ModelRouter | null {
+  const { executive, summarizer, deliberation, conversation } = roles
+  const distinct = ( model: string | null ): model is string => !!model && model !== executive
+
+  const rules: RoutingRule[] = []
+  if( distinct( summarizer ) )
+    rules.push( { category: 'summarizer', route: { model: summarizer } } )
+  if( distinct( deliberation ) )
+    rules.push( { function: 'deliberation', route: { model: deliberation } } )
+  if( distinct( conversation ) ){
+    // Outreach is the same voice speaking first — it has always shared the
+    // conversation model, and splitting it is the host's call, via a router.
+    rules.push( { function: 'conversation', route: { model: conversation } } )
+    rules.push( { function: 'outreach',     route: { model: conversation } } )
+  }
+
+  return rules.length > 0 ? new TableRouter( rules, 'role-map') : null
+}
+
 export function resolveModelRoles( model?: string | WillModelConfig ): ExecutiveModelRoles & { embedding: string | null } {
   const map = typeof model === 'string' ? { executive: model } : ( model ?? {} )
   const pin = process.env.WILL_LLM_MODEL
@@ -223,16 +352,6 @@ export interface WillConfig {
   /** Anatomy — 'mind' (default) or the no-LLM 'reflex' shell. */
   anatomy?: Anatomy
 
-  /**
-   * Concrete LLM model id(s) for this Will — a single id for every role, or a
-   * per-role map. An explicit WILL_LLM_MODEL env pins the thinking roles
-   * (operator single-model deployments); unset roles fall back to `executive`,
-   * then the LLMDirector's built-in default. Product-level labels (pricing
-   * tiers, model families) live host-side and resolve to concrete ids BEFORE
-   * reaching the engine.
-   */
-  model?: string | WillModelConfig
-
   /**
    * Per-Will LLM transport overrides (provider, BYO apiKey, baseUrl, output
    * cap, timeout). Unset fields fall back to WILL_LLM_* envs. The apiKey never
@@ -359,17 +478,17 @@ export interface MindAssembly {
   outbox:               OutboxMessage[]
 }
 
-// ── Cadence defaults per tier ─────────────────────────────────
+// ── Named executive cadences ──────────────────────────────────
 
 /**
  * Named executive cadences — ticks between LLM calls. Lower = reasons more often
- * (more responsive, higher COGS). Customers pick via `config.executiveInterval`
- * (clamped to `minExecutiveInterval`). See monetization.md "Cost Per Will-Hour".
+ * (more responsive, more tokens per Will-hour). Callers pick via
+ * `config.executiveInterval` (clamped to `minExecutiveInterval`).
  */
 export const EXECUTIVE_CADENCE = {
-  responsive: 30,  // Sonnet — premium/Enterprise; opt in via executiveInterval
-  balanced:   60,  // Sonnet — Pro default
-  economy:    90,  // Haiku  — Starter default
+  responsive: 30,  // most attentive, highest spend — opt in via executiveInterval
+  balanced:   60,  // default
+  economy:    90,  // least attentive, lowest spend
 } as const
 
 
@@ -666,6 +785,10 @@ function _constructCognition(
   // (attachTokenTracker), so usage/cost never conflates across Wills and
   // parallel runs stay isolated.
   const tokenTracker = new TokenTracker({
+    // Host prices, flattened from the per-provider map. Cost is telemetry only
+    // (it never enters state), so this can differ run to run without touching
+    // determinism.
+    prices:                  mergeProviderPrices( config.llm?.providers ),
     emitCostEvents:          true,
     costWarningThresholdUsd: 0.02,
     willId,
@@ -708,7 +831,7 @@ function _constructCognition(
 
   // Per-Will, per-ROLE models (env WILL_LLM_MODEL pins all thinking roles —
   // operator single-model deployments). No tier vocabulary inside the engine.
-  const modelRoles = resolveModelRoles( config.model )
+  const modelRoles = resolveModelRoles( config.llm?.model )
 
   const { embedder, vectorMemory } = _resolveVectorMemory( willId, randomSeed, config.vectorMemoryAdapter, config.disableVectorMemory, tokenTracker, config.testMode, modelRoles.embedding ?? undefined )
   const episodicConsolidator = new EpisodicConsolidator( vectorMemory ? { vectorMemory, ...(embedder ? { embedder } : {}) } : {} )
@@ -746,13 +869,21 @@ function _constructCognition(
   const executiveEngine   = new ExecutiveEngine({ executiveInterval, cooldownTicks: 5 })
 
   executiveEngine.willId = willId
-  executiveEngine.llm    = config.llm ?? null
-  executiveEngine.models = {
-    executive:    modelRoles.executive,
-    summarizer:   modelRoles.summarizer,
-    deliberation: modelRoles.deliberation,
-    conversation: modelRoles.conversation,
-  }
+  // Narrow the host's per-provider map to credentials for the call path; the
+  // prices from that same map went to the TokenTracker above.
+  // W7 — the per-role model map compiles into routing rules and joins the
+  // host's own router in one chain, so the engine receives a single answer to
+  // "which model serves this call?" instead of two. The host's router leads:
+  // that is the precedence the two mechanisms already had.
+  const roleRouter = compileRoleRouter( modelRoles )
+  executiveEngine.llm    = config.llm
+    ? {
+        ...config.llm,
+        ...( config.llm.providers ? { credentials: providerCredentials( config.llm.providers ) } : {} ),
+        router: chainRouters( config.llm.router, roleRouter ),
+      }
+    : ( roleRouter ? { router: roleRouter } : null )
+  executiveEngine.modelId = modelRoles.executive
   if( config.testMode ) executiveEngine.setTestMode( true )
   executiveEngine.attachWorkingMemory( workingMemory )
   executiveEngine.attachGoalManager( goalManager )

package/src/stem/policy/arbiter.ts

@@ -33,15 +33,28 @@
 export type PolicyDecision = 'allow' | 'deny' | 'escalate'
 
 /**
- * Is this denial a property of the ACTION CLASS (never permitted under the
- * active policy) or of THIS INSTANCE (wrong target, exceeded bound)?
+ * WHY this denial is final — the distinction that makes a refusal learnable
+ * rather than a wall to re-probe forever. Each value selects a different
+ * cognitive fate; they are not degrees of one severity.
  *
- * This is the distinction that makes a refusal learnable rather than a wall to
- * re-probe forever, and it is the field we are proposing upstream to HELM. A
- * 'class' denial should suppress the affordance; an 'instance' denial should
- * only narrow the parameter envelope the Will reaches for.
+ *   • 'class'     — the ACTION ITSELF is never permitted. Suppress the
+ *                   affordance hard, erase any learned envelope, and let go of
+ *                   a commitment currently deliberating toward it.
+ *   • 'parameter' — the action is fine; THESE ARGUMENTS were not (bound
+ *                   exceeded, wrong target). Narrow the envelope the Will
+ *                   reaches for; the ability stays.
+ *   • 'context'   — the refusal was NOT ABOUT THE ACTION at all (tainted
+ *                   context, unavailable dependency). Touch nothing: no
+ *                   availability delta, no envelope, no competence.
+ *
+ * POLICY_REAFFERENCE P5 widened this from 'class' | 'instance' after the HELM
+ * joint RFC ("Denials That Teach") identified that an instance-scoped refusal
+ * splits in two, and that the two halves demand opposite responses. These are
+ * OUR names for the distinctions, deliberately not HELM's wire spellings — see
+ * the naming-boundary note in .TODO/POLICY_REAFFERENCE.md. A provider adapter
+ * translates; this interface stays vendor-neutral.
  */
-export type DenialFinality = 'class' | 'instance'
+export type DenialFinality = 'class' | 'parameter' | 'context'
 
 /**
  * The nearest allowed envelope — what WOULD have been permitted. Structured so
@@ -64,9 +77,8 @@ export interface Verdict {
   decision:        PolicyDecision
   /** Stable machine-readable code, e.g. 'TARGET_NOT_ALLOWED'. Never prose. */
   reasonCode?:     string
-  /** Meaningful on 'deny' only. Absent ⇒ treat as 'instance' (the safe default:
-   *  it narrows rather than suppresses, so a mis-tagged denial cannot silently
-   *  delete an ability from the Will's reach). */
+  /** Meaningful on 'deny' only. Absent ⇒ treat as 'parameter' — see
+   *  `asFinality` for why that, and not 'context', is the safe default. */
   finality?:       DenialFinality
   counterfactual?: PolicyCounterfactual
   /** Free-text for logs and host UX. NEVER parsed by cognition. */
@@ -127,10 +139,33 @@ export function isNullArbiter( arbiter: PolicyArbiter | null | undefined ): bool
   return !arbiter || arbiter === NULL_ARBITER
 }
 
+/** Normalize a denial's finality. Absent ⇒ 'parameter' (see `asFinality`). */
+export function finalityOf( verdict: Verdict ): DenialFinality {
+  return asFinality( verdict.finality )
+}
+
 /**
- * Normalize a denial's finality. Absent ⇒ 'instance', the conservative reading:
- * an unlabelled refusal narrows the envelope but never removes the ability.
+ * Normalize an UNTYPED finality — one read back off entity metadata, a verdict
+ * tape, or a host ack, where the type system cannot help.
+ *
+ * Every such read goes through here rather than comparing string literals at
+ * the call site: the enum is a moving target (it widened once for the HELM
+ * joint RFC and may again), and a hand-written `=== 'class'` scattered through
+ * cognition is a mis-route that still typechecks.
+ *
+ * THE DEFAULT IS 'parameter', AND NEVER 'context'. The intuitive reading — an
+ * unlabelled denial should do the LEAST, so default to the fate that touches
+ * nothing — is wrong, and dangerously so. 'context' means *the mind learns
+ * nothing from this denial*, so it re-probes the same wall forever: the exact
+ * failure this whole epoch exists to fix, silently re-enabled for any provider
+ * that doesn't tag its refusals. 'context' is a claim only a provider that
+ * actually knows can make — it must be ASSERTED, never defaulted to.
+ * 'parameter' narrows without deleting, which is the honest conservative
+ * reading and preserves pre-P5 behaviour for an untagged denial exactly.
+ *
+ * Legacy 'instance' (the pre-P5 spelling) normalizes to 'parameter' by the same
+ * fallback, so tapes and snapshots written before the split replay unchanged.
  */
-export function finalityOf( verdict: Verdict ): DenialFinality {
-  return verdict.finality === 'class' ? 'class' : 'instance'
+export function asFinality( raw: unknown ): DenialFinality {
+  return raw === 'class' ? 'class' : raw === 'context' ? 'context' : 'parameter'
 }

package/src/stem/policy/rule.table.ts

@@ -37,7 +37,7 @@ export interface ParamConstraint {
  *
  * `require` is meaningful with `decision: 'allow'` only: the scope matched, and
  * these constraints must hold for the allow to stand. A violation flips the
- * verdict to deny — carrying the counterfactual — with finality 'instance',
+ * verdict to deny — carrying the counterfactual — with finality 'parameter',
  * because the ability itself was permitted and only these arguments were not.
  *
  * A rule with `decision: 'deny'` and no `require` is a flat class-level ban;
@@ -94,7 +94,7 @@ export class RuleTableArbiter implements PolicyArbiter {
         return {
           decision:       'deny',
           reasonCode:     rule.reasonCode ?? violation.reasonCode,
-          finality:       rule.finality ?? 'instance',
+          finality:       rule.finality ?? 'parameter',
           counterfactual: violation.counterfactual,
         }
 

package/src/stem/tracts/effector.controller.ts

@@ -24,7 +24,8 @@
 import { logger } from '#core/logger'
 import { reconcileInvocation } from '#agency/reconcile.learning'
 import { NULL_ARBITER, isNullArbiter } from '#stem/policy/arbiter'
-import type { PolicyArbiter, PolicyInvocation, Verdict } from '#stem/policy/arbiter'
+import type { PolicyArbiter, PolicyInvocation, Verdict, DenialFinality, PolicyCounterfactual } from '#stem/policy/arbiter'
+import { finalityOf, asFinality } from '#stem/policy/arbiter'
 import {
   getVerdictRecorder, getVerdictSource, type PolicyVerdictRecord,
 } from '#stem/policy/verdict.recorder'
@@ -36,9 +37,38 @@ interface PendingRefusal {
   intentId:   string
   schema:     string
   reasonCode: string
-  finality:   string
+  finality:   DenialFinality
+  /** ENVELOPE_NARROWING P0 — what WOULD have been allowed, carried through to
+   *  the outcome the mind learns from. Absent on refusals that have no bound to
+   *  report (a flat ban, a fault, an unanswered escalation). */
+  counterfactual?: PolicyCounterfactual
 }
 
+/**
+ * The verdict a fault produces (POLICY_REAFFERENCE P5, conformance S9).
+ *
+ * An arbiter that throws or rejects has always failed CLOSED — the effect is
+ * withheld — but it used to withhold *silently*, queueing no refusal. The held
+ * intent then expired at the executor's AWAIT_TIMEOUT and reconciled as a plain
+ * failure, landing on COMPETENCE: a PDP outage taught the mind it was unskilled
+ * at something it is perfectly capable of. So a fault now yields a real verdict:
+ *
+ *   • 'deny'    — still fail-closed, unchanged. The effect never reaches the world.
+ *   • 'context' — but it teaches NOTHING. The arbiter being unreachable is not a
+ *                 fact about the ability, so nothing about the ability may move.
+ *
+ * It goes through `_recordAndApply` rather than straight to the refusal queue so
+ * the fault lands on the VERDICT TAPE too. That closes a replay hole: an
+ * unrecorded fault left the source with nothing to re-feed, and a source miss
+ * reproduces a buffered ALLOW — so a live run that withheld the effect would
+ * have replayed as one that dispatched it.
+ */
+const ARBITER_FAULT_VERDICT: Readonly<Verdict> = Object.freeze({
+  decision:   'deny' as const,
+  reasonCode: 'ARBITER_UNAVAILABLE',
+  finality:   'context' as const,
+})
+
 /** How long an escalated intent is held awaiting a resolution before it degrades
  *  to a refusal — 2× the host-ack timeout, so a human has real time to answer. */
 const ESCALATION_TTL_TICKS = 30
@@ -136,6 +166,7 @@ export class effectorController {
     try { verdict = this._arbiter.evaluate( invocation ) }
     catch( err ){
       logger.error(`[policy] arbiter "${this._arbiter.name}" threw for "${invocation.schema}" — failing closed:`, err )
+      this._recordAndApply( instance, payload, invocation, ARBITER_FAULT_VERDICT )
       return
     }
 
@@ -145,7 +176,10 @@ export class effectorController {
       // queue drains each tick, so a verdict landing a few ticks late still lands.
       void verdict.then(
         v => this._recordAndApply( instance, payload, invocation, v ),
-        err => logger.error(`[policy] arbiter "${this._arbiter.name}" rejected for "${invocation.schema}" — failing closed:`, err ),
+        err => {
+          logger.error(`[policy] arbiter "${this._arbiter.name}" rejected for "${invocation.schema}" — failing closed:`, err )
+          this._recordAndApply( instance, payload, invocation, ARBITER_FAULT_VERDICT )
+        },
       )
       return
     }
@@ -218,7 +252,8 @@ export class effectorController {
         intentId:   invocation.intentId,
         schema:     invocation.schema,
         reasonCode: verdict.reasonCode ?? 'POLICY_DENIED',
-        finality:   verdict.finality ?? 'instance',
+        finality:   finalityOf( verdict ),
+        ...( verdict.counterfactual ? { counterfactual: verdict.counterfactual } : {} ),
       })
       this._pendingRefusals.set( instance.config.id, queue )
       return
@@ -272,7 +307,8 @@ export class effectorController {
       this.confirmExecution( instance, refusal.intentId, {
         success:     false,
         refused:     true,
-        finality:    refusal.finality === 'class' ? 'class' : 'instance',
+        finality:    refusal.finality,
+        ...( refusal.counterfactual ? { counterfactual: refusal.counterfactual } : {} ),
         description: `refused by policy: ${refusal.reasonCode} (${refusal.finality})`,
       } )
   }
@@ -317,7 +353,16 @@ export class effectorController {
     }
   }
 
-  /** Degrade escalations no one answered in time into instance-refusals (P4). */
+  /**
+   * Degrade escalations no one answered in time into light refusals (P4).
+   *
+   * Finality 'parameter' is chosen for its BEHAVIOUR, not its name: silence is
+   * not literally an argument problem, but the light-dent-with-recovery it
+   * produces is exactly right — a Will whose asks go unanswered should ask
+   * progressively less, and should resume asking if someone starts answering.
+   * 'class' would be a lie (nobody said never) and 'context' would teach
+   * nothing, leaving the mind to escalate forever into an empty room.
+   */
   private _expireEscalations( instance: WillInstance, tick: number ): void {
     const active = this._activeEscalations.get( instance.config.id )
     if( !active || active.size === 0 ) return
@@ -325,14 +370,14 @@ export class effectorController {
       if( tick < esc.expiresAt ) continue
       active.delete( intentId )
       this._clearEscalated( instance, intentId )
-      this._queueRefusal( instance, esc.intentId, esc.schema, 'ESCALATION_EXPIRED', 'instance')
+      this._queueRefusal( instance, esc.intentId, esc.schema, 'ESCALATION_EXPIRED', 'parameter')
       logger.info(`[policy] escalation EXPIRED → refusing "${esc.schema}" intent "${intentId}"`)
     }
   }
 
   /** Push a refusal onto the queue drained by _applyRefusals this same tick. */
   private _queueRefusal(
-    instance: WillInstance, intentId: string, schema: string, reasonCode: string, finality: 'class' | 'instance',
+    instance: WillInstance, intentId: string, schema: string, reasonCode: string, finality: DenialFinality,
   ): void {
     const queue = this._pendingRefusals.get( instance.config.id ) ?? []
     queue.push({ intentId, schema, reasonCode, finality })
@@ -419,7 +464,9 @@ export class effectorController {
       /** POLICY_REAFFERENCE P2 — set when the ack is a policy refusal, so the
        *  ReafferenceEngine routes it to availability rather than competence. */
       refused?:    boolean
-      finality?:   'class' | 'instance'
+      finality?:   DenialFinality
+      /** ENVELOPE_NARROWING P0 — the bound that was exceeded, if the arbiter said. */
+      counterfactual?: PolicyCounterfactual
     },
   ): void {
     const tick = instance.tickCount