@ngockhoale/ukit 3.4.46 → 3.4.48

package/template_project/.claude/ukit/index/tier-lane.mjs

@@ -0,0 +1,202 @@
+// Tier-lane dispatch: who performs the edit (worker hand-off vs inline) for a routed task, and the
+// tier of the MAIN session. A leaf module (node builtins only) so route-task.mjs and the
+// UserPromptSubmit hook share ONE implementation — the hook cannot import the large route-task CLI.
+import * as fsSync from 'node:fs';
+import path from 'node:path';
+
+// WS-E tier-role wiring: a contract tier only takes effect when the executing session hands
+// the work to an agent whose definition binds that tier — otherwise every session behaves as
+// if it only had one model. Labels are stable tier roles (lite/code/smart), never provider
+// or model identity. Vision never appears here — it is a capability lane, not a cost tier.
+//
+// `mainTier` is the tier the MAIN session actually runs on (resolveMainTier; null = unknown).
+//  - main is not smart (or unknown): legacy behavior — `code` is the silent default lane,
+//    lite/smart get a hand-off.
+//  - main is smart (UKit's default orchestrator): the smart lane is silent. A code lane is
+//    dispatched to its Tier 2 worker only where delegationPolicy admits it; `disallow` lanes
+//    (tiny-fix/local-fix) stay inline because the hand-off costs more than the work, and
+//    `disallow-by-default` (local-build) delegates only for multi-file / long edit loops.
+export const TIER_WORKER_AGENT = { lite: 'ukit-small-task-maintainer', code: 'feature-implementer' };
+
+// @decision-point orchestration.tier-lane-dispatch — deterministic choice of who performs the edit
+// (worker hand-off vs inline) from tier, main tier, delegation policy and risk; regression:
+// tests/orchestration/tierRiskIndependence.test.js, mainTierLane.test.js.
+export function buildTierLane({ modelTier = null, escalatedTier = null, mainTier = null, mainTierSource = null, delegationPolicy = null, executionMode = null, complexityHigh = false, riskHigh = false, playbookId = null, subagentSession = false } = {}) {
+  const tier = escalatedTier ?? modelTier;
+  if (!tier || tier === 'vision') {
+    return null;
+  }
+  // A host-marked subagent session IS the worker: it executes the brief it was handed. Handing the
+  // same brief onward (or requiring a delegation it cannot make) would nest orchestration — omp runs
+  // the router in child sessions too (live: child session routed with mainTier smart).
+  if (subagentSession) {
+    return { tier, mainTier: null, mainTierSource: 'subagent-session', defaultLane: true, executorTier: tier, instruction: null, subagentSession: true };
+  }
+  // Effort is independent of tier and of risk: Medium unless complexity evidence (verified failure /
+  // stuck) says High. The per-task effort can only be bound on a dispatch (Agent tool `effort` / omp
+  // task effort); the running session's own effort is never changed mid-task, so an inline lane
+  // records the High need as unbound.
+  const effort = complexityHigh ? 'high' : null;
+  const withEffort = (instruction) => (instruction && effort
+    ? `${instruction} Complexity evidence is high: pass effort="high" on that Agent/task call.`
+    : instruction);
+  const effortFields = effort ? { effort, effortBinding: 'dispatch-param-only' } : {};
+  if (mainTier !== 'smart') {
+    return {
+      tier,
+      defaultLane: tier === 'code',
+      instruction: tier === 'code'
+        ? null
+        : withEffort(`Hand this task to an agent bound to the ${tier} tier instead of doing it inline, unless this session already runs on the ${tier} tier.`),
+      ...effortFields,
+    };
+  }
+  const policy = delegationPolicy ?? 'allow-qualified-sidecar';
+  const brief = 'Give the worker scope, dependencies, acceptance criteria and the verification to run; verify its diff yourself after it returns, then run the project\'s bare test runner yourself (e.g. `npm test`, no pipe/tail/grep/compound command) and read its exit status — that status is the verification evidence.';
+  // A high-risk target on a Tier 2 coding lane is still Tier 2 work: the inline-by-policy exemption
+  // (hand-off costs more than the work) does not apply, otherwise the Tier 3 orchestrator would be the
+  // one editing the dangerous file. Risk raises verification rigor, not the executor.
+  if (tier === 'code' && riskHigh && (policy === 'disallow' || policy === 'disallow-by-default')) {
+    const worker = executionMode === 'find-cause' ? 'bug-debugger' : TIER_WORKER_AGENT.code;
+    return {
+      tier, mainTier, mainTierSource, defaultLane: false, executorTier: 'code', delegationRequired: true, ...effortFields,
+      instruction: withEffort(`High-risk target: hand the implementation to a code-tier worker (${worker}) instead of editing inline; this session runs on the smart tier. ${brief}`),
+    };
+  }
+  // A routed feature-implementation playbook is the contract-bearing / multi-surface build path, not a
+  // small local edit: the inline-by-policy exemption (hand-off costs more than the work) belongs to
+  // small-feature, so the Tier 3 orchestrator hands this implementation to the Tier 2 worker.
+  if (tier === 'code' && playbookId === 'feature-implementation' && policy === 'disallow-by-default') {
+    return {
+      tier, mainTier, mainTierSource, defaultLane: false, executorTier: 'code', delegationRequired: true, ...effortFields,
+      instruction: withEffort(`Feature-implementation playbook: hand the implementation to a code-tier worker (${TIER_WORKER_AGENT.code}) instead of editing inline; this session runs on the smart tier. ${brief}`),
+    };
+  }
+  // executorTier = the tier that actually performs the edit: the worker's when a hand-off is
+  // instructed, the main session's when the lane stays inline (an inline lane under a smart main is
+  // Tier 3 work), null when the hand-off is conditional on edit size.
+  const base = { tier, mainTier, mainTierSource, defaultLane: tier === 'smart', ...effortFields };
+  // Failure evidence escalated a coding lane to smart: the orchestrator takes the analysis, not the edit.
+  // Where delegation is admitted it still hands the implementation to the Tier 2 worker with its diagnosis.
+  if (tier === 'smart' && modelTier === 'code' && policy !== 'disallow' && policy !== 'disallow-by-default') {
+    const worker = executionMode === 'find-cause' ? 'bug-debugger' : TIER_WORKER_AGENT.code;
+    return {
+      ...base,
+      defaultLane: false,
+      executorTier: 'code',
+      delegationRequired: true,
+      instruction: withEffort(`Repeated failure evidence escalated this task: do the root-cause analysis yourself, then hand the implementation to a code-tier worker (${worker}) with your diagnosis instead of editing inline. ${brief}`),
+    };
+  }
+  if (tier === 'smart' || policy === 'disallow') {
+    return { ...base, executorTier: mainTier, instruction: null };
+  }
+  const worker = executionMode === 'find-cause' && tier === 'code' ? 'bug-debugger' : TIER_WORKER_AGENT[tier];
+  return {
+    ...base,
+    executorTier: policy === 'disallow-by-default' ? null : tier,
+    ...(policy === 'disallow-by-default' ? {} : { delegationRequired: true }),
+    instruction: withEffort(policy === 'disallow-by-default'
+      ? `Work inline unless the change spans several files or needs a long edit loop; then hand it to a ${tier}-tier worker (${worker}). ${brief}`
+      : `Hand the implementation to a ${tier}-tier worker (${worker}) instead of doing it inline; this session runs on the smart tier. ${brief}`),
+  };
+}
+
+const MODEL_TIER_ALIASES = [
+  [/opus|unic-smart|^slow$|^smart$/, 'smart'],
+  [/sonnet|unic-code|^default$|^code$/, 'code'],
+  [/haiku|unic-lite|^smol$|^lite$/, 'lite'],
+];
+
+/** Maps a model alias/id/role to lite|code|smart (config modelTiers first, then name families). */
+export function classifyModelTier(model, config = null) {
+  const value = typeof model === 'string' ? model.trim().toLowerCase().replace(/\[[^\]]*\]$/, '').replace(/:(off|minimal|low|medium|high|xhigh|max|auto)$/, '') : '';
+  if (!value) {
+    return null;
+  }
+  const tiers = config?.orchestration?.modelTiers;
+  for (const name of ['lite', 'code', 'smart']) {
+    const entry = tiers?.[name];
+    if (entry && [entry.claudeModel, entry.genericModel, entry.ompRole].some((v) => typeof v === 'string' && v.toLowerCase() === value)) {
+      return name;
+    }
+  }
+  const bare = value.includes('/') ? value.slice(value.lastIndexOf('/') + 1) : value;
+  return MODEL_TIER_ALIASES.find(([re]) => re.test(bare))?.[1] ?? null;
+}
+
+function readJsonFileSync(file) {
+  try {
+    return JSON.parse(fsSync.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Tier of the MAIN session, with provenance: {tier, source}. Host-selected model first
+ * (Claude Code: ANTHROPIC_MODEL > settings.local.json > settings.json `model`; OMP: the model the
+ * bridge recorded at session_start), then orchestration.orchestratorModel. Unknown → {tier:null}
+ * so buildTierLane keeps the legacy behavior. Never infers a model from anything else.
+ */
+export function resolveMainTier({ rootDir = null, config = null, env = process.env, sessionId = null } = {}) {
+  const candidates = [];
+  if (env?.UKIT_HARNESS === 'codex') {
+    return { tier: null, source: 'unknown' }; // codex cannot bind a model; never guess its main tier
+  }
+  if (env?.UKIT_HARNESS === 'omp') {
+    const recorded = rootDir ? readJsonFileSync(path.join(rootDir, '.ukit', 'storage', 'cache', 'session-main-model.json')) : null;
+    // STRICT ownership: the record is a single per-project slot describing ONE main session
+    // (the omp bridge stamps the writer's host session id). Without the caller's host session
+    // id — or with a record that is unstamped (a pre-provenance/legacy write) or owned by a
+    // DIFFERENT session — the OMP main tier is UNKNOWN: never read a foreign slot, and never
+    // fall through to the Claude orchestrator default on another session's data. The omp bridge
+    // refreshes the owner's record on session_start/session_switch/before_agent_start
+    // (observed-active-model-changed), so a matched owner sees current state, not a stale role.
+    const owned = recorded?.harness === 'omp'
+      && typeof sessionId === 'string' && sessionId !== ''
+      && typeof recorded.session === 'string' && recorded.session !== ''
+      && recorded.session === sessionId;
+        // OMP result owns the answer end-to-end: never fall through to the Claude
+    // orchestrator default on top of (or instead of) this harness's own record.
+    return { tier: classifyModelTier(owned ? (recorded.role ?? recorded.model) : null, config), source: owned ? 'omp-session' : 'unknown' };
+  } else {
+    candidates.push(['env:ANTHROPIC_MODEL', env?.ANTHROPIC_MODEL]);
+    for (const file of ['settings.local.json', 'settings.json']) {
+      candidates.push([`.claude/${file}`, rootDir ? readJsonFileSync(path.join(rootDir, '.claude', file))?.model : null]);
+    }
+  }
+  candidates.push(['orchestration.orchestratorModel', config?.orchestration?.orchestratorModel]);
+  for (const [source, model] of candidates) {
+    const tier = classifyModelTier(model, config);
+    if (tier) {
+      return { tier, source };
+    }
+  }
+  return { tier: null, source: 'unknown' };
+}
+
+/**
+ * Attaches `tierLane` to a route summary from the final route fields. Shared by the route CLI and the
+ * UserPromptSubmit hook so both persist the same delegation requirement; the Stop-side playbook
+ * acceptance reads `tierLane.delegationRequired` from that persisted state.
+ */
+export function applyTierLaneToRouteSummary(routeSummary, { rootDir = null, config = null, env = process.env, complexityHigh = false, subagentSession = false, sessionId = null } = {}) {
+  if (!routeSummary || typeof routeSummary !== 'object') {
+    return routeSummary;
+  }
+  const mainTier = resolveMainTier({ rootDir, config, env, sessionId });
+  routeSummary.tierLane = buildTierLane({
+    modelTier: routeSummary.executionContract?.modelTier ?? routeSummary.execution?.modelTier ?? null,
+    escalatedTier: routeSummary.escalatedTier ?? null,
+    mainTier: mainTier.tier,
+    mainTierSource: mainTier.source,
+    delegationPolicy: routeSummary.executionContract?.delegationPolicy ?? null,
+    executionMode: routeSummary.executionMode ?? null,
+    complexityHigh,
+    riskHigh: routeSummary.riskFloor?.floor === 'high-risk',
+    playbookId: routeSummary.playbookId ?? null,
+    subagentSession: subagentSession === true,
+  });
+  return routeSummary;
+}

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -82,7 +82,9 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
   const hasOutputField = typeof response === 'string' || typeof response?.stdout === 'string' || typeof response?.output === 'string';
   let role = null; let proven = false; let target = null; let remoteSync = null;
   for (const seg of real) {
-    if (!seg || /^cd\s+\S+$/.test(seg) || DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))) continue;
+    // `git diff --check` is a real verification, not a dry-run mutation.
+    if (!seg || /^cd\s+\S+$/.test(seg) || (DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))
+      && !(domain === 'git-integrity' && /^git\s+diff\s+--check(?:\s|$)/.test(seg)))) continue;
     if (domain === 'git-integrity') {
       const lsRemote = seg.match(GIT_LS_REMOTE);
       if (lsRemote) {