@miraland-labs/conduit-bridge 0.16.42 → 0.16.100

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.16.27` — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
+**Package version:** `0.16.95` — Conduit-fuel lanes bind organization aliases (T144), the Anthropic base URL is the origin (T148), the investigation lane resolves its model (T154); a hosted container image lives under `hosted/` (docs/HOSTED_RUNNER.md). Earlier (0.16.27) — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
 
 ## Prerequisites
 

package/dist/attempt-watchdog.js

@@ -0,0 +1,88 @@
+/**
+ * T90: an attempt that stops answering must end, not hold its lease for ever.
+ *
+ * Field, 2026-09-07: a cursor attempt was claimed at 15:24 and was still `running` at 18:30 with
+ * the lease renewed on every heartbeat, while the runner had no child process and the journal had
+ * printed nothing since the model line. One awaited step never returned, and the Bridge had no
+ * clock of its own above the agent turn: the attempt could only end when that step answered.
+ *
+ * The watchdog is that clock. It carries the phase the attempt is in, prints each transition to
+ * the journal, and rejects `stalled` when the phase has not moved for its own budget. The phase
+ * name travels with the failure, so the next reader knows which step never returned.
+ */
+/** How long a phase may stay silent after the step that can answer has finished. */
+export const ATTEMPT_STALL_GRACE_MS = 15 * 60_000;
+/**
+ * Phases that may run an agent turn or the project's own gates, so their budget is the turn budget
+ * plus the grace. Every other phase is bookkeeping the machine does alone: the grace is enough, and
+ * a shorter clock reports a stall sooner.
+ */
+const AGENT_TURN_PHASES = new Set([
+    "claim",
+    "agent",
+    "verification",
+    "report_repair",
+    "land",
+]);
+/** The end of an attempt that stopped answering, naming the step that never returned. */
+export class AttemptStalledError extends Error {
+    phase;
+    waitedMs;
+    constructor(phase, waitedMs) {
+        super(`bridge_attempt_stalled: phase=${phase}; the step gave no answer for ${Math.round(waitedMs / 60_000)} minutes`);
+        this.phase = phase;
+        this.waitedMs = waitedMs;
+        this.name = "AttemptStalledError";
+    }
+}
+/** Bound one awaited step. The rejection names the phase, as a stall report does. */
+export function withTimeout(promise, ms, phase) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new AttemptStalledError(phase, ms)), ms);
+        timer.unref?.();
+        promise.then((value) => { clearTimeout(timer); resolve(value); }, (error) => { clearTimeout(timer); reject(error); });
+    });
+}
+export function createAttemptWatchdog(input) {
+    let fail = () => undefined;
+    const stalled = new Promise((_resolve, reject) => { fail = reject; });
+    // The attempt usually wins the race and nobody ever reads this rejection.
+    stalled.catch(() => undefined);
+    const journal = input.journal ?? ((line) => console.log(line));
+    let turnBudgetMs = input.turnBudgetMs;
+    let current = "claim";
+    let timer = null;
+    let stopped = false;
+    const arm = (ms) => {
+        if (timer)
+            clearTimeout(timer);
+        if (stopped)
+            return;
+        timer = setTimeout(() => fail(new AttemptStalledError(current, ms)), ms);
+        timer.unref?.();
+    };
+    const budgetFor = (name) => AGENT_TURN_PHASES.has(name) ? turnBudgetMs + ATTEMPT_STALL_GRACE_MS : ATTEMPT_STALL_GRACE_MS;
+    arm(budgetFor(current));
+    return {
+        stalled,
+        phase(name) {
+            if (stopped)
+                return;
+            current = name;
+            journal(`Assignment ${input.taskId} phase: ${name}`);
+            arm(budgetFor(name));
+        },
+        budget(next) {
+            if (stopped || !(next > 0))
+                return;
+            turnBudgetMs = next;
+            arm(budgetFor(current));
+        },
+        stop() {
+            stopped = true;
+            if (timer)
+                clearTimeout(timer);
+            timer = null;
+        },
+    };
+}

package/dist/brief.js

@@ -12,7 +12,7 @@ const MANIFESTS = [
 ];
 /** Prefer test before typecheck/lint so discovery order matches what pickVerificationCommand wants. */
 const VERIFICATION_SCRIPTS = ["test", "verify", "typecheck", "lint", "build"];
-const MAKE_VERIFICATION_TARGETS = ["test", "check", "verify", "replay", "typecheck", "lint", "build"];
+export const MAKE_VERIFICATION_TARGETS = ["test", "check", "verify", "replay", "typecheck", "lint", "build"];
 const EXCLUDED_DIRECTORIES = new Set(["node_modules", "dist", "build", "target", "coverage", ".venv", "venv"]);
 export async function buildWorkspaceBrief(workspace) {
     const entries = await readdir(workspace, { withFileTypes: true });
@@ -59,7 +59,8 @@ export async function isBaseCommitAncestor(workspace, baseCommit, headCommit) {
         throw error;
     }
 }
-async function fetchOrigin(workspace) {
+/** Refresh every origin ref; deepens a shallow clone enough to see a commit a tip fetch missed. */
+export async function fetchOrigin(workspace) {
     await execFileAsync("git", ["-C", workspace, "fetch", "--no-tags", "origin"], {
         timeout: 120_000,
         windowsHide: true,
@@ -168,6 +169,8 @@ export async function resolveAttemptStartCommit(workspace, requestedBase, claime
  * recipe body was always repository-authored.
  */
 const MAX_DECLARED_VERIFICATION = 8;
+/** Keep in sync with `workspaceBriefSchema.verification` in `src/runner/routes.ts`. */
+const MAX_VERIFICATION_COMMANDS = 10;
 export function parseDeclaredVerification(text) {
     const declared = [];
     for (const raw of text.split("\n")) {
@@ -182,12 +185,30 @@ export function parseDeclaredVerification(text) {
     return declared;
 }
 export async function readDeclaredVerification(workspace) {
+    let text;
     try {
-        return parseDeclaredVerification(await readFile(join(workspace, ".conduit", "verification"), "utf8"));
+        text = await readFile(join(workspace, ".conduit", "verification"), "utf8");
     }
     catch {
         return []; // no declaration, or unreadable: discovery still applies
     }
+    const declared = parseDeclaredVerification(text);
+    // A line the shape check refuses, or a line after the eighth, was dropped with no reason given:
+    // the gate was then absent from every list and the operator had nothing to read. One line per
+    // dropped declaration says which line went and why it can go.
+    for (const raw of text.split("\n")) {
+        const line = raw.split("#")[0].trim();
+        if (!line || declared.includes(line))
+            continue;
+        console.warn(JSON.stringify({
+            event: "declared_verification_dropped",
+            line: line.slice(0, 200),
+            reason: isBoundedVerificationCommand(line)
+                ? `more than ${MAX_DECLARED_VERIFICATION} declared commands`
+                : "not a bounded verification command",
+        }));
+    }
+    return declared;
 }
 export async function discoverVerificationCommands(workspace, files) {
     // Declared first: the order is a preference order for every reader that takes one command.
@@ -240,5 +261,8 @@ export async function discoverVerificationCommands(workspace, files) {
         if (files.has("gradlew"))
             commands.push("./gradlew test");
     }
-    return [...new Set(commands)];
+    // The heartbeat schema caps `verification` at 10. A gate-rich checkout discovers more than that,
+    // and the whole heartbeat was then refused: the computer went dark with no reason on any card.
+    // Declared commands come first, so the cap removes only the least preferred discovered names.
+    return [...new Set(commands)].slice(0, MAX_VERIFICATION_COMMANDS);
 }

package/dist/cli.js

@@ -7,12 +7,12 @@ import { createInterface } from "node:readline/promises";
 import { chmodSync, cpSync, existsSync, mkdirSync, readdirSync } from "node:fs";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
-import { ConduitClient, ConduitRequestError } from "./client.js";
+import { assignmentPollBehindServer, ConduitClient, ConduitRequestError } from "./client.js";
 import { BRIDGE_LEASE_CAPACITY, BRIDGE_MAX_LEASE_CAPACITY, clampLeaseCapacity, clearLocalConnection, clearPendingConnection, loadConfig, loadConfigIfPresent, loadOrCreateInstallationId, loadPendingConnection, redactSecrets, saveConfig, saveConfigPrefs, saveDriverQuota, savePendingConnection, suggestMachineName, } from "./config.js";
 import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
-import { DRIVERS } from "./driver.js";
-import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriversOnline, laneDispatchBlock, laneStatuses, } from "./drivers.js";
+import { DRIVERS, MODEL_TIERS } from "./driver.js";
+import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriverModels, setDriversOnline, formatLaneTiers, laneDispatchBlock, laneStatuses, } from "./drivers.js";
 import { buildWorkspaceBrief } from "./brief.js";
 import { parseAgentTimeoutMinutes } from "./execution-budget.js";
 import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts } from "./execution-facts.js";
@@ -21,7 +21,8 @@ import { buildOnShiftIntentProof, maybeApplyOnShiftIntent } from "./on-shift-app
 import { loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
 import { pumpExecutionSlots, renewLeases } from "./execution.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
-import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, unavailableWorkspacePreflight } from "./preflight.js";
+import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, PREFLIGHT_CACHE_TTL_MS, unavailableWorkspacePreflight } from "./preflight.js";
+import { refreshSourceWorkspace } from "./workspace-refresh.js";
 import { executeNextInvestigation } from "./investigation.js";
 import { bridgeVersion } from "./version.js";
 const [command] = process.argv.slice(2);
@@ -45,6 +46,16 @@ function parseBootstrapResult(value) {
         throw new Error(`Bootstrap result must be one of: ${BOOTSTRAP_RESULTS.join(", ")}`);
     return result;
 }
+/** Managed authority comes from this Bridge installation's ops.env, never from the control plane. */
+function configuredManagedRoot() {
+    try {
+        const configured = loadOpsEnv().CONDUIT_MANAGED_ROOT.trim();
+        return configured ? resolve(configured) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function connect() {
     const { values } = parseArgs({ args: process.argv.slice(3), options: { url: { type: "string" }, code: { type: "string" }, fuel: { type: "string" } } });
     if (!values.url || !values.code)
@@ -277,7 +288,7 @@ async function finishConnection(baseUrl, data, fuelSource) {
     const client = new ConduitClient(config);
     let heartbeatOk = true;
     try {
-        await heartbeat(client, config, null, null, unavailableWorkspacePreflight({ config }));
+        await heartbeat(client, config, null, null, unavailableWorkspacePreflight({ config, managedRoot: configuredManagedRoot() }));
     }
     catch {
         heartbeatOk = false;
@@ -407,7 +418,7 @@ async function initOps() {
 async function opsCommand() {
     const verb = process.argv[3];
     if (!verb || !OPS_VERBS.includes(verb)) {
-        throw new Error(`Usage: ${bridgeUsage("ops", "<connect|install|switch|online|offline|quota-clear|status|doctor|disconnect|uninstall>", "[driver…]")} (install also takes --workspace <path> [--repo <url>])`);
+        throw new Error(`Usage: ${bridgeUsage("ops", "<connect|install|switch|online|offline|quota-clear|status|workspace|doctor|disconnect|uninstall>", "[driver…]")} (install also takes --workspace <path> [--repo <url>])`);
     }
     await runOps(verb, process.argv.slice(4));
 }
@@ -444,12 +455,16 @@ async function driversCommand() {
             // Printing the count is the only way an operator sees why dispatch keeps avoiding this lane.
             const slow = lane.timeouts ? `  timeouts=${lane.timeouts} (demoted)` : "";
             console.log(`  ${lane.id.padEnd(14)} ${lane.state.padEnd(8)} fuel=${lane.fuel}  allowance=${lane.allowance}${when}${reset}${slow}  (${lane.label})`);
+            // An unbound tier runs the CLI default and Holds on the first vendor abort, so the map is
+            // printed here — the operator learned a typo such as `fast` only from that Hold before.
+            console.log(`                 tiers  ${formatLaneTiers(lane.tiers)}`);
         }
         const blocked = laneDispatchBlock(laneStatuses(config));
         console.log(blocked
             ? `Dispatch: BLOCKED — ${blocked}.`
             : `Dispatch: ready — eligible ${laneStatuses(config).filter((lane) => lane.eligible).map((lane) => lane.id).join(", ")}.`);
         const online = onlineDriverIds(config);
+        console.log(`Bind a tier: ${bridgeUsage("drivers", "models", "<driver-id>", MODEL_TIERS.join("|"), "<model…>")}`);
         console.log(online.length
             ? `Toggle a lane: ${bridgeUsage("drivers", "online|offline", "<id…>")}`
             : `All offline — no new claims. Bring one online: ${bridgeUsage("drivers", "online", AGENT_PLACEHOLDER)}`);
@@ -500,7 +515,20 @@ async function driversCommand() {
         console.log(`${driverLabel(id)} lane fuel set to ${mode}`);
         return;
     }
-    throw new Error(`Usage: ${bridgeUsage("drivers", "[list|online|offline|fuel|quota]", "…")}`);
+    if (sub === "models") {
+        const id = process.argv[4]?.trim();
+        const tier = process.argv[5]?.trim();
+        const names = process.argv.slice(6).map((name) => name.trim()).filter(Boolean);
+        if (!id || !tier || !MODEL_TIERS.includes(tier) || !names.length) {
+            throw new Error(`Usage: ${bridgeUsage("drivers", "models", "<driver-id>", MODEL_TIERS.join("|"), "<model…>")}`);
+        }
+        config = seedDriverLanes(config, [id]).config;
+        config = setDriverModels(config, id, tier, names);
+        await saveConfigPrefs(config);
+        console.log(`${driverLabel(id)} lane ${tier} tier: ${names.join(", ")}`);
+        return;
+    }
+    throw new Error(`Usage: ${bridgeUsage("drivers", "[list|online|offline|fuel|models|quota]", "…")}`);
 }
 async function runner() {
     applyRunnerToolPath();
@@ -525,6 +553,7 @@ async function runner() {
         throw new Error("--ensure-checkout requires --workspace <repository-path>");
     }
     const workspace = values.workspace ? resolve(values.workspace) : null;
+    const managedRoot = configuredManagedRoot();
     if (workspace && values["ensure-checkout"]) {
         const result = await ensureCheckout(workspace, values["ensure-checkout"]);
         console.log(result === "cloned"
@@ -562,10 +591,13 @@ async function runner() {
             config.drivers = latest.drivers;
             config.fuelSource = latest.fuelSource;
             config.leaseCapacity = latest.leaseCapacity;
+            // Refresh before discovery: the brief and the readiness report must describe origin's code,
+            // not whatever this checkout was left on. Cadence is the readiness report's own, not the beat.
+            const refresh = workspace ? await reportedRefresh(workspace) : null;
             const currentBrief = workspace ? await buildWorkspaceBrief(workspace).catch(() => brief) : null;
             const preflight = workspace
-                ? await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined })
-                : unavailableWorkspacePreflight({ config });
+                ? await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh })
+                : unavailableWorkspacePreflight({ config, managedRoot });
             const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
             if (hb.staleBridge) {
                 console.error(`Bridge update required: running protocol ${BRIDGE_PROTOCOL_VERSION}; control plane requires protocol ${hb.requiredProtocol ?? "unknown"} (minimum Bridge ${hb.minimumVersion ?? "unknown"}). Reinstall the latest Bridge, then restart this runner.`);
@@ -609,13 +641,16 @@ async function runner() {
             if (workspace && onlineDriverIds(config).length) {
                 // Observation runs before authoring: an owner waiting on an answer should not queue behind
                 // a long delivery, and the control plane already counted this slot as busy.
-                progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs) || progressed;
+                progressed = await executeNextInvestigation(client, config, workspace, brief, timeoutMs, {
+                    managedRoot: hb.on_shift?.managed_workspace_root ?? null,
+                }) || progressed;
             }
             if (workspace && onlineDriverIds(config).length) {
                 // Read the workspace again, then publish it. The last brief stands if the read fails.
                 const publishWorkspaceState = async (options = {}) => {
+                    const refresh = await reportedRefresh(workspace, options);
                     const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
-                    const preflight = await cachedBridgePreflight({ config, workspace, brief: currentBrief ?? undefined }, options);
+                    const preflight = await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh }, options);
                     const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
                     return { preflight, hb };
                 };
@@ -634,7 +669,9 @@ async function runner() {
                         return preflight.ready && lane?.ready === true && typeof lane.version === "string" && lane.version.length > 0;
                     },
                     heartbeatIntervalMs: intervalMs,
-                }, running, {});
+                    // T86: a computer on shift for several projects moves to the assignment's repository
+                    // under this root when it claims.
+                }, running, { managedRoot: hb.on_shift?.managed_workspace_root ?? null });
             }
         }
         catch (error) {
@@ -648,6 +685,34 @@ async function runner() {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }
+/** Last state announced, so a workspace that stays diverged does not print on every cycle. */
+let lastRefreshState = null;
+/** Last refresh and when it ran, so the fetch keeps the readiness report's cadence. */
+let lastRefresh = null;
+/**
+ * Fast-forward the source workspace and announce only what changed.
+ *
+ * The fetch runs on the readiness report's cadence, not the heartbeat's: forced before every claim,
+ * and at most once every five minutes otherwise. A fetch on every fifteen-second beat is traffic
+ * nothing can use, because the readiness report it feeds only recomputes on that same cadence.
+ */
+async function reportedRefresh(workspace, options = {}) {
+    if (!options.force && lastRefresh && Date.now() - lastRefresh.at < PREFLIGHT_CACHE_TTL_MS)
+        return lastRefresh.result;
+    const refresh = await refreshSourceWorkspace(workspace).catch(() => null);
+    lastRefresh = { at: Date.now(), result: refresh };
+    const state = refresh ? `${refresh.state}:${refresh.local_commits}` : null;
+    if (state !== lastRefreshState) {
+        lastRefreshState = state;
+        if (refresh?.state === "fast_forwarded") {
+            console.log(`Workspace fast-forwarded to origin/${refresh.branch}.`);
+        }
+        else if (refresh?.state === "diverged") {
+            console.error(`Workspace cannot fast-forward: ${refresh.local_commits} local-only commit(s) on ${refresh.branch}. Park or push them; this computer takes no work until it can follow origin.`);
+        }
+    }
+    return refresh;
+}
 async function heartbeat(client, config, workspacePath, brief, preflight, intentProof, bootstrapResult) {
     const online = onlineDriverIds(config);
     const status = heartbeatStatusForDrivers(online);
@@ -660,6 +725,16 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
         bridgeProtocol: BRIDGE_PROTOCOL_VERSION,
         bootstrapResult,
     });
+    // T98: an assignments poll that has failed schema validation flags this runner as behind the
+    // server, so the control plane can tell the operator to restart it instead of leaving the runner
+    // to fail every poll silently. Merged in here rather than into runBridgePreflight itself: the
+    // preflight probe is cached for minutes at a time, and this fact must reach the very next
+    // heartbeat.
+    const preflightToSend = {
+        ...preflight,
+        ...(assignmentPollBehindServer() ? { runner_behind_server: true } : {}),
+        ...(process.env.CONDUIT_RUNNER_SERVICE === "container" ? { runner_service: "container" } : {}),
+    };
     const response = await client.request("/runner/v1/heartbeat", { method: "POST", body: JSON.stringify({
             status,
             capabilities: config.capabilities,
@@ -669,7 +744,7 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
             bridge_version: version,
             bridge_protocol: BRIDGE_PROTOCOL_VERSION,
             drivers: driversHeartbeatReport(config, config.activeAttempts),
-            preflight,
+            preflight: preflightToSend,
             execution_facts: executionFacts,
             ...(intentProof ? { on_shift_intent_proof: intentProof } : {}),
             ...(brief ? { workspace_brief: brief } : {}),

package/dist/client.js

@@ -2,12 +2,44 @@ import { removeRuntimeAttempt, saveConfigPrefs, saveRuntime } from "./config.js"
 export class ConduitRequestError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    details;
+    constructor(message, status, code, 
+    /** The control plane's own structured reason, e.g. which execution fact changed. */
+    details) {
         super(message);
         this.status = status;
         this.code = code;
+        this.details = details;
     }
 }
+// T98: a server wire-shape change (e.g. T96's released_worktree_attempt_ids) can move ahead of an
+// older runner's schema. The old failure mode printed the full zod issue dump on every poll — one
+// stranded runner logged the same 25-issue dump every cycle and never said what to do about it.
+// This runner logs one short line per minute instead, and flags itself on the next heartbeat so the
+// control plane can tell the operator to restart it.
+let assignmentPollShapeUnderstood = true;
+let lastAssignmentPollShapeWarningAt = 0;
+const ASSIGNMENT_POLL_SHAPE_WARNING_INTERVAL_MS = 60_000;
+/** Call when the /runner/v1/assignments response fails schema validation. */
+export function reportAssignmentPollShapeMismatch(bridgeVersion) {
+    assignmentPollShapeUnderstood = false;
+    const now = Date.now();
+    if (now - lastAssignmentPollShapeWarningAt < ASSIGNMENT_POLL_SHAPE_WARNING_INTERVAL_MS)
+        return;
+    lastAssignmentPollShapeWarningAt = now;
+    console.error(`assignment poll: response shape not understood — this runner (v${bridgeVersion}) is behind the server; restart it`);
+}
+/** True once an assignments poll has failed schema validation. Read by the next heartbeat. */
+export function assignmentPollBehindServer() {
+    return !assignmentPollShapeUnderstood;
+}
+/** Test-only: put the module back to its just-started state between cases. */
+export function resetAssignmentPollShapeState() {
+    assignmentPollShapeUnderstood = true;
+    lastAssignmentPollShapeWarningAt = 0;
+}
+/** The longest one control-plane call may take before the caller gets an error instead of a wait. */
+const CONTROL_PLANE_TIMEOUT_MS = 120_000;
 export class ConduitClient {
     config;
     persistRuntime;
@@ -32,11 +64,14 @@ export class ConduitClient {
     async request(path, init = {}) {
         const response = await fetch(`${this.config.baseUrl}${path}`, {
             ...init,
+            // T90: every control-plane call of an attempt is bounded. A request that never answers used
+            // to be an awaited step with no clock above it, and the attempt could not end.
+            signal: init.signal ?? AbortSignal.timeout(CONTROL_PLANE_TIMEOUT_MS),
             headers: { authorization: `Bearer ${this.config.runnerKey}`, "content-type": "application/json", ...init.headers },
         });
         const data = await response.json();
         if (!response.ok)
-            throw new ConduitRequestError(data.error?.message ?? `Conduit request failed (${response.status})`, response.status, data.error?.code);
+            throw new ConduitRequestError(data.error?.message ?? `Conduit request failed (${response.status})`, response.status, data.error?.code, data.error?.details);
         return data;
     }
     async claim(taskId, attemptId, extras) {
@@ -53,6 +88,7 @@ export class ConduitClient {
                 ...(extras?.driverId ? { driver_id: extras.driverId } : {}),
                 ...(extras?.fuelMode ? { fuel_mode: extras.fuelMode } : {}),
                 ...(extras?.fuelProvenance ? { fuel_provenance: extras.fuelProvenance } : {}),
+                ...(extras?.startCommit ? { start_commit: extras.startCommit } : {}),
             }),
         });
         const active = {
@@ -65,6 +101,7 @@ export class ConduitClient {
             ...(extras?.fuelMode ? { fuelMode: extras.fuelMode } : {}),
             ...(extras?.executionKind ? { executionKind: extras.executionKind } : {}),
             ...(extras?.sourceAttemptId ? { sourceAttemptId: extras.sourceAttemptId } : {}),
+            ...(extras?.sourceWorkspace ? { sourceWorkspace: extras.sourceWorkspace } : {}),
         };
         this.config.activeAttempts[taskId] = active;
         await this.persistRuntime(this.config);

package/dist/config.js

@@ -2,6 +2,7 @@ import { chmod, mkdir, open, readFile, rename, unlink, writeFile, stat } from "n
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+import { MODEL_TIERS } from "./driver.js";
 /** Serialize config writes in-process so concurrent claim/phase updates cannot clobber each other. */
 let saveChain = Promise.resolve();
 /** Default when join omits --capacity. */
@@ -84,18 +85,59 @@ export async function loadConfigIfPresent() {
             if (!lane || typeof lane !== "object")
                 continue;
             const state = lane.state === "online" ? "online" : "offline";
+            const modelsPolicy = lane.models_policy === "declared" ? "declared" : undefined;
             const fuel = lane.fuel === "local" || lane.fuel === "conduit" ? lane.fuel : undefined;
             // Every field a lane carries must be listed here. This sanitizer duplicates the shape check in
             // `normalizeDrivers` (drivers.ts) — importing it would close the loop config → drivers → driver
             // → config — so a new lane field has to be added in both, and forgetting here is silent: the
             // value survives in memory, then vanishes on the next load. `quota` was lost exactly that way.
             const quota = plainQuota(lane.quota);
-            cleaned[id] = { state, ...(fuel ? { fuel } : {}), ...(quota ? { quota } : {}) };
+            const models = plainTierModels(lane.models, `drivers.${id}.models`);
+            cleaned[id] = { state, ...(modelsPolicy ? { models_policy: modelsPolicy } : {}), ...(fuel ? { fuel } : {}), ...(quota ? { quota } : {}),
+                ...(models && Object.keys(models).length ? { models } : {}) };
         }
         config.drivers = cleaned;
     }
+    if (config.models !== undefined)
+        config.models = plainTierModels(config.models, "models");
     return config;
 }
+/** Tier keys already reported. The runner reloads the config every 15 seconds; one warning is enough. */
+const warnedTierKeys = new Set();
+/**
+ * Keep only the three intelligence tiers, and name each other key one time.
+ *
+ * A key such as `fast` is not a tier, so it binds nothing: every package of that risk runs the
+ * CLI default and the first vendor abort Holds. Dropping the key silently is what made that typo
+ * findable only from the Hold, hours later.
+ */
+function plainTierModels(raw, where) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const kept = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (MODEL_TIERS.includes(key)) {
+            if (typeof value === "string" || Array.isArray(value))
+                kept[key] = value;
+            continue;
+        }
+        const named = `${where}.${key}`;
+        if (warnedTierKeys.has(named))
+            continue;
+        warnedTierKeys.add(named);
+        console.warn(`Bridge configuration: \`${named}\` is not an intelligence tier and is ignored. The tiers are ${MODEL_TIERS.join(", ")}.`);
+    }
+    return kept;
+}
+/**
+ * Model candidates for one tier on one lane, best first: the lane's own map, then the machine-wide
+ * map. One reader for every surface — resolution, the preflight report and the operator printers.
+ */
+export function tierCandidates(config, driverId, tier) {
+    const configured = config.drivers?.[driverId]?.models?.[tier] ?? config.models?.[tier];
+    const listed = !configured ? [] : (Array.isArray(configured) ? configured : [configured]);
+    return listed.filter((candidate) => typeof candidate === "string" && candidate.trim().length > 0);
+}
 /** A stored quota record, or nothing. Malformed is dropped rather than thrown — see normalizeQuota. */
 function plainQuota(raw) {
     if (!raw || typeof raw !== "object")
@@ -104,7 +146,10 @@ function plainQuota(raw) {
         return undefined;
     if (raw.resets_at !== null && typeof raw.resets_at !== "string")
         return undefined;
-    return { exhausted: raw.exhausted, resets_at: raw.resets_at, observed_at: raw.observed_at };
+    // The vendor is half the record's key, so it must survive the write. Losing it here would make
+    // every stored refusal lane-wide again on the next load.
+    const vendor = typeof raw.vendor === "string" && raw.vendor.trim() ? raw.vendor : undefined;
+    return { exhausted: raw.exhausted, resets_at: raw.resets_at, observed_at: raw.observed_at, ...(vendor ? { vendor } : {}) };
 }
 async function loadRuntime() {
     try {
@@ -394,5 +439,14 @@ export function suggestMachineName(host, installationId) {
     return `${base.slice(0, 199 - suffix.length)}-${suffix}`;
 }
 export function redactSecrets(value) {
-    return value.replace(/(runner_sk_|gateway_sk_|lease_|connect_)[A-Za-z0-9-]+/g, "$1[redacted]");
+    // Conduit's own key classes, then the provider and forge shapes an agent's own environment
+    // carries (ANTHROPIC_API_KEY, XAI_API_KEY, GEMINI_API_KEY, a GitHub token, a bearer header) —
+    // an agent that prints its environment on failure must not leak them through this terminal.
+    return value
+        .replace(/(runner_sk_|gateway_sk_|lease_|connect_)[A-Za-z0-9-]+/g, "$1[redacted]")
+        .replace(/sk-[A-Za-z0-9_-]{8,}/g, "sk-[redacted]")
+        .replace(/xai-[A-Za-z0-9]+/g, "xai-[redacted]")
+        .replace(/AIza[0-9A-Za-z_-]{35}/g, "AIza[redacted]")
+        .replace(/(ghp_|gho_|github_pat_|glpat-)[A-Za-z0-9_-]+/g, "$1[redacted]")
+        .replace(/Bearer\s+\S+/g, "Bearer [redacted]");
 }