@ngockhoale/ukit 3.4.47 → 3.4.48

package/template_project/.claude/ukit/index/route-task.mjs

@@ -17,6 +17,9 @@ import {
   writeRecentCacheEntry,
 } from './cache-utils.mjs';
 import { ROUTE_CATALOG } from './route-catalog.mjs';
+import { buildTierLane, classifyModelTier, resolveMainTier } from './tier-lane.mjs';
+// Public surface unchanged for tests and callers that import the lane helpers from the route CLI.
+export { buildTierLane, classifyModelTier, resolveMainTier };
 import { detectUnicGateway } from './unic-gateway.mjs';
 import { withAsyncLock } from '../runtime/async-lock.mjs';
 import { appendDecisionReceipt, recordLedgerEvent } from '../runtime/execution-ledger.mjs';
@@ -1068,6 +1071,7 @@ export async function routeTask(input = {}, { signal = null, deadlineMs = null,
     recentOutputSnapshot,
     previousRouteSummary: normalizedInput.previousRouteSummary ?? null,
     escalationConfig,
+    sessionId: normalizedInput.sessionId ?? null,
     // BL-018: caller-injected seams — the in-process entry accepts a prior
     // emission (exhaustion check) and a stubbed decision/registrar for tests.
     escalationDecision: normalizedInput.escalationDecision ?? null,
@@ -1109,6 +1113,40 @@ export async function routeTask(input = {}, { signal = null, deadlineMs = null,
 
 export { DEFAULT_ROUTE_DEADLINE_MS, DEFAULT_ROUTE_IO_BUDGET };
 
+const TASK_INSTANCE_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,95}$/;
+// The prompt hook owns turn boundaries: every real user turn writes a fresh state (new id) with one of
+// these sources before the model can run this CLI. A CLI-only environment (Codex: "invoked by
+// instruction") has no such boundary, so there an identical prompt is a REPEATED request and mints a new id.
+const HOOK_STATE_SOURCES = ['skill-router', 'skill-router-provisional'];
+
+// @decision-point task.instance-id-ownership — deterministic reuse-vs-mint ownership decision (the
+// task boundary every evidence receipt is filtered by); regression: tests/index/taskIdentityContinuity.test.js.
+/**
+ * Same task => same id; genuinely new task => fresh id. Returns { id, origin }.
+ *
+ * An id is reused only from a previous state (already session-filtered by main()) that provably belongs
+ * to the SAME hook-owned turn: it was written by the hook, or by this CLI refreshing that hook turn
+ * (taskIdOrigin 'hook'), AND the prompt is identical (or the refresh is prompt-less: tool command / target
+ * only, routed from the stored explicit prompt). The origin ends at a continue phrase, a different prompt,
+ * or any state the hook did not own, so a repeated request still mints a new id and unrelated evidence
+ * stays rejected. An explicit --task-instance-id is honored when well-formed.
+ */
+export function reuseOrMintTaskInstanceId({ previousState = {}, promptText = '', commandText = '', targetFile = null, explicitId = null, continuingTask = false } = {}) {
+  const explicit = typeof explicitId === 'string' ? explicitId.trim() : '';
+  if (explicit && TASK_INSTANCE_ID_SHAPE.test(explicit)) return { id: explicit, origin: null };
+  const prevId = previousState?.taskInstanceId;
+  if (prevId) {
+    const hookTurn = HOOK_STATE_SOURCES.includes(previousState.source)
+      || (previousState.source === 'task-route' && previousState.taskIdOrigin === 'hook');
+    const stored = previousState.routingContext?.lastExplicitUserPromptText;
+    const samePrompt = Boolean(stored) && stored === promptText;
+    const promptlessRefresh = Boolean(stored) && !promptText && Boolean(commandText || targetFile);
+    if (hookTurn && (samePrompt || promptlessRefresh)) return { id: prevId, origin: 'hook' };
+    if (continuingTask) return { id: prevId, origin: null };
+  }
+  return { id: `task-${crypto.randomBytes(16).toString('hex')}`, origin: null };
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const rootDir = getRootDir(args);
@@ -1169,11 +1207,14 @@ async function main() {
   const continuingTask = Boolean(previousState.taskInstanceId && lastPrompt
     && /^(?:continue|resume|keep going|go on|proceed|tiep tuc|lam tiep)(?:\s+(?:with\s+)?(?:the\s+|this\s+)?(?:previous\s+|last\s+|current\s+|same\s+)?(?:implementation\s+)?(?:task|work))?(?:\s+(?:thoi|di|đi|nhe|nao|nua|a|ha|please|pls|now|then))*\s*[.!]?$/i.test(
       promptText.normalize('NFD').replace(/[̀-ͯ]/g, '').trim()));
-  const taskInstanceId = readFlagValue(args, '--task-instance-id')
-    || (((['skill-router', 'skill-router-provisional'].includes(previousState.source)
-      && previousState.routingContext?.lastExplicitUserPromptText === promptText) || continuingTask)
-      && previousState.taskInstanceId
-      ? previousState.taskInstanceId : `task-${crypto.randomBytes(16).toString('hex')}`);
+  const { id: taskInstanceId, origin: taskIdOrigin } = reuseOrMintTaskInstanceId({
+    previousState,
+    promptText,
+    commandText,
+    targetFile,
+    explicitId: readFlagValue(args, '--task-instance-id'),
+    continuingTask,
+  });
   if (continuingTask) promptText = lastPrompt;
   const preparedRoute = await prepareTaskRoute({
     rootDir,
@@ -1269,7 +1310,7 @@ async function main() {
         historySignals,
       };
     }
-    const sharedState = { ...reusableState, taskInstanceId, source: 'task-route', ts: Date.now() };
+    const sharedState = { ...reusableState, taskInstanceId, taskIdOrigin, source: 'task-route', ts: Date.now() };
     if (canPersistRouteState) {
       try { await persistSharedRouteState(sharedStatePath, sharedState); }
       catch (error) { console.error(`route-task: state persist degraded — ${error?.message ?? error}`); }
@@ -1324,6 +1365,8 @@ async function main() {
       applyEscalationToRouteSummary(rescuedRouteSummary, {
         config: escalationConfig,
         targetFile: cachedRouteState.routingContext?.targetFile ?? null,
+        rootDir: rootDir,
+        sessionId,
       });
       // BL-018: re-run the fix-loop transition on the rescued summary — a
       // refreshed fixLoopCount may trip, escalate, or exhaust (BLOCKED); the
@@ -1357,6 +1400,7 @@ async function main() {
     const sharedState = {
       ...cachedRouteState,
       taskInstanceId,
+      taskIdOrigin,
       ...(sessionId ? { sessionId } : {}),
       source: 'task-route',
       ts: Date.now(),
@@ -1420,6 +1464,7 @@ async function main() {
     sessionId,
     taskInstanceId,
   });
+  if (taskIdOrigin) sharedState.taskIdOrigin = taskIdOrigin;
   if (canPersistRouteState) {
     // Advisory persistence — an EACCES/ENOSPC under the lock must never lose
     // the printed route; degrade to stderr and print anyway.
@@ -2504,6 +2549,8 @@ async function finalizeTaskRoute({
   applyEscalationToRouteSummary(routeSummary, {
     config: escalationConfig,
     targetFile: routingContext.targetFile ?? null,
+    rootDir: absoluteRoot,
+    sessionId,
   });
   // BL-018 (SPEC FR-006): fix-loop escalation. historySignals.fixLoopCount is
   // fingerprint-joined (same routeFingerprint/requestKey, never session-wide);
@@ -2694,6 +2741,9 @@ function printRouteState(state) {
   }
   if (state.routeSummary?.tierLane?.instruction) {
     console.log(`tierLane: ${state.routeSummary.tierLane.instruction}`);
+    if (state.routeSummary.tierLane.delegationRequired === true && state.taskInstanceId) {
+      console.log(`handback: start each worker prompt with "[ukit-task ${state.taskInstanceId}]" so its result binds to this task`);
+    }
   }
   if (state.routeSummary?.escalatedTier) {
     console.log(`escalatedTier: ${state.routeSummary.escalatedTier}`);
@@ -3182,7 +3232,7 @@ function deriveIntentMode({ promptText = '', commandText = '', targetFile = null
   }
 
   if (concreteTask) {
-    if (/\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|timeout)\b/.test(lower)) {
+    if (/\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|timeout)\b/.test(lower.replace(/\b(?:throw|raise|emit|reject|return|log|show|surface)(?:s|es|ing)?\s+(?:an?\s+|the\s+)?(?:[a-z-]+\s+){0,2}[a-z]*(?:error|exception)s?\b/g, ' '))) {
       return 'debug-specific';
     }
     if (/\b(review|audit|diff|pr feedback|code review|kiem tra|soat)\b/.test(raw)) {
@@ -4186,7 +4236,7 @@ function deriveExecutionScores({
   const buildSignal = /\b(build|create|add|implement|feature)\b/.test(raw);
   const debugSignal = intentMode === 'debug-specific' || /\b(root cause|debug|triage|flaky|investigate|why)\b/.test(raw);
   const reviewSignal = intentMode === 'review-specific' || /\b(review|audit|verify|release readiness)\b/.test(raw);
-  const failureSignal = /\b(failing|failed|broken|error|crash|timeout|undefined|exception|eacces|trace)\b/.test(raw);
+  const failureSignal = /\b(failing|failed|broken|error|crash|timeout|undefined|exception|eacces|trace)\b/.test(raw.replace(/\b(?:throw|raise|emit|reject|return|log|show|surface)(?:s|es|ing)?\s+(?:an?\s+|the\s+)?(?:[a-z-]+\s+){0,2}[a-z]*(?:error|exception)s?\b/g, ' '));
   const impactSignal = /\b(map impact|impact|blast radius|all affected|across (?:runtime|templates|helpers|adapters|mirrors)|affected adapters|affected mirrors|inspect impact)\b/.test(raw);
   const boundedEditSignal = /\b(one[- ]line|small|tiny|single|local|guard|log line|loading message|label)\b/.test(raw);
   const implementSignal = /\b(implement|apply|update|modify|add|create|ship|deliver|fix)\b/.test(raw)
@@ -5026,10 +5076,16 @@ function resolveEscalationSettings(config = null) {
  * Escalates exactly one rung above `modelTier` on `tierOrder`, capped at `cap`. Returns null when
  * escalation is disabled, `repeatCount` hasn't reached `debugLoopThreshold`, or `modelTier` isn't
  * on the cost ladder (e.g. no contract selected). Never returns 'vision'.
- * FR-005: when `riskEscalation.level === 'high'` the repeat-count threshold is treated as
- * satisfied (immediate one-rung escalation) and the effective cap rises to 'smart', overriding
- * the configured cap; the reason is prefixed `risk-floor:` so consumers can tell risk-driven
- * escalation from repeat-count escalation.
+ * FR-005: `riskEscalation` (level 'high') is the Stop-gate carrier and has two kinds of evidence with
+ * different meaning here:
+ *  - `stuck-risk` (verified failure evidence): the repeat-count threshold is treated as satisfied
+ *    (immediate one-rung escalation) and the effective cap rises to 'smart', overriding the
+ *    configured cap. This is a capability escalation, so it also counts as complexity evidence.
+ *  - `risk-floor` only (the task touches something dangerous): risk raises verification rigor, not the
+ *    model tier. It lifts a Tier 1 chore to the Tier 2 executor at most, so a code lane is never
+ *    relabelled smart and the Tier 3 orchestrator is never turned into the implementation worker.
+ * The reason is prefixed `stuck-risk:` / `risk-floor:` so consumers can tell the kinds apart from
+ * repeat-count escalation. `complexityEvidence` is the only input that may ask for High effort.
  */
 function computeEscalation({
   modelTier = null,
@@ -5042,8 +5098,11 @@ function computeEscalation({
     return null;
   }
   const settings = resolveEscalationSettings(config);
-  const riskDriven = riskEscalation?.level === 'high';
-  if (!settings.enabled || (!riskDriven && (!Number.isFinite(repeatCount) || repeatCount < settings.debugLoopThreshold))) {
+  const riskHigh = riskEscalation?.level === 'high';
+  const stuckDriven = riskHigh && (riskEscalation.sources ?? []).includes('stuck-risk');
+  const floorDriven = riskHigh && !stuckDriven;
+  const repeatDriven = Number.isFinite(repeatCount) && repeatCount >= settings.debugLoopThreshold;
+  if (!settings.enabled || (!stuckDriven && !floorDriven && !repeatDriven)) {
     return null;
   }
   const currentIndex = settings.tierOrder.indexOf(modelTier);
@@ -5052,22 +5111,30 @@ function computeEscalation({
   }
   const capIndex = settings.tierOrder.indexOf(settings.cap);
   const smartIndex = settings.tierOrder.indexOf('smart');
-  const effectiveCapIndex = riskDriven
+  const codeIndex = settings.tierOrder.indexOf('code');
+  let effectiveCapIndex = stuckDriven
     ? (smartIndex === -1 ? settings.tierOrder.length - 1 : smartIndex)
     : (capIndex === -1 ? settings.tierOrder.length - 1 : capIndex);
+  if (floorDriven && !repeatDriven && codeIndex !== -1) {
+    effectiveCapIndex = Math.min(effectiveCapIndex, codeIndex);
+  }
   const escalatedIndex = Math.min(currentIndex + 1, effectiveCapIndex);
+  if (floorDriven && !repeatDriven && escalatedIndex <= currentIndex) {
+    return null;
+  }
   const escalatedTier = settings.tierOrder[escalatedIndex];
 
   return {
     escalatedTier,
-    escalationReason: riskDriven
-      ? `risk-floor: level=${riskEscalation.level} sources=${(riskEscalation.sources ?? []).join(',')} file=${targetFile ?? 'null'}`
+    complexityEvidence: stuckDriven || repeatDriven,
+    escalationReason: stuckDriven || floorDriven
+      ? `${stuckDriven ? 'stuck-risk' : 'risk-floor'}: level=${riskEscalation.level} sources=${(riskEscalation.sources ?? []).join(',')} file=${targetFile ?? 'null'}`
       : `repeat-count=${repeatCount} threshold=${settings.debugLoopThreshold} file=${targetFile ?? 'null'}`,
   };
 }
 
 /** Attaches escalatedTier/escalationReason to routeSummary, additive alongside modelTier. */
-export function applyEscalationToRouteSummary(routeSummary = null, { config = null, targetFile = null } = {}) {
+export function applyEscalationToRouteSummary(routeSummary = null, { config = null, targetFile = null, rootDir = null, sessionId = null } = {}) {
   if (!routeSummary || typeof routeSummary !== 'object') {
     return routeSummary;
   }
@@ -5089,9 +5156,17 @@ export function applyEscalationToRouteSummary(routeSummary = null, { config = nu
   }
   // Recomputed here (not only in buildRouteSummary) so the lane always reflects the final
   // tier after escalation, on every path that emits a route summary.
+  const mainTier = resolveMainTier({ rootDir, config, sessionId: sessionId ?? null });
   routeSummary.tierLane = buildTierLane({
     modelTier: routeSummary.executionContract?.modelTier ?? null,
     escalatedTier: escalation?.escalatedTier ?? null,
+    mainTier: mainTier.tier,
+    mainTierSource: mainTier.source,
+    delegationPolicy: routeSummary.executionContract?.delegationPolicy ?? null,
+    executionMode: routeSummary.executionMode ?? null,
+    complexityHigh: escalation?.complexityEvidence === true,
+    riskHigh: routeSummary.riskFloor?.floor === 'high-risk',
+    playbookId: routeSummary.playbookId ?? null,
   });
 
   return routeSummary;
@@ -5156,25 +5231,6 @@ function appendRiskEscalationSegment(routeSummary = null) {
   return routeSummary;
 }
 
-// WS-E tier-role wiring: a contract tier only takes effect when the executing session hands
-// the work to an agent whose definition binds that tier — otherwise every session behaves as
-// if it only had one model. `code` is the DEFAULT implementation lane, so a code-tier contract
-// produces no instruction (inline execution on a code session is already correct, and silence
-// keeps the hook flow smooth). Labels are stable tier roles (lite/code/smart), never provider
-// or model identity. Vision never appears here — it is a capability lane, not a cost tier.
-function buildTierLane({ modelTier = null, escalatedTier = null } = {}) {
-  const tier = escalatedTier ?? modelTier;
-  if (!tier || tier === 'vision') {
-    return null;
-  }
-  return {
-    tier,
-    defaultLane: tier === 'code',
-    instruction: tier === 'code'
-      ? null
-      : `Hand this task to an agent bound to the ${tier} tier instead of doing it inline, unless this session already runs on the ${tier} tier.`,
-  };
-}
 
 function advanceContinuationState(continuationState = null, previousContinuationState = null, thresholds = null) {
   if (!continuationState || typeof continuationState !== 'object') {
@@ -6028,6 +6084,27 @@ function shouldIncludeRecentOutput({
   return true;
 }
 
+// Orchestration telemetry for the audit row: what the route REQUESTED (tier lane / effort) next to
+// what the host evidences. Effective values are never inferred from an alias — the only host
+// evidence available to a hook child is the CLAUDE_EFFORT env; the model stays UNKNOWN.
+// skill-router.sh builds the same object (audit row parity).
+export function buildOrchestrationAudit(routeSummary = null, env = process.env) {
+  const lane = routeSummary?.tierLane;
+  if (!lane || typeof lane !== 'object') {
+    return null;
+  }
+  return {
+    mainTier: lane.mainTier ?? null,
+    mainTierSource: lane.mainTierSource ?? null,
+    requestedTier: lane.tier ?? null,
+    lane: lane.instruction ? (lane.mainTier === 'smart' ? 'dispatch-worker' : 'handoff') : 'inline',
+    requestedEffort: lane.effort ?? null,
+    effortBinding: lane.effortBinding ?? null,
+    effectiveEffort: env?.CLAUDE_EFFORT || 'UNKNOWN',
+    effectiveModel: 'UNKNOWN',
+  };
+}
+
 function buildRouteAuditEntry({ route = null, state = null } = {}) {
   const routingContext = route?.routingContext ?? state?.routingContext ?? {};
   const routeSummary = route?.routeSummary ?? state?.routeSummary ?? {};
@@ -6086,6 +6163,7 @@ function buildRouteAuditEntry({ route = null, state = null } = {}) {
     // BL-013: bounded history counters on the audit row — same struct as the
     // route record, identical to the hook's audit emission.
     historySignals: routeSummary?.historySignals ?? null,
+    orchestration: buildOrchestrationAudit(routeSummary),
   };
 }
 

package/template_project/.claude/ukit/index/tier-lane.mjs

@@ -0,0 +1,202 @@
+// Tier-lane dispatch: who performs the edit (worker hand-off vs inline) for a routed task, and the
+// tier of the MAIN session. A leaf module (node builtins only) so route-task.mjs and the
+// UserPromptSubmit hook share ONE implementation — the hook cannot import the large route-task CLI.
+import * as fsSync from 'node:fs';
+import path from 'node:path';
+
+// WS-E tier-role wiring: a contract tier only takes effect when the executing session hands
+// the work to an agent whose definition binds that tier — otherwise every session behaves as
+// if it only had one model. Labels are stable tier roles (lite/code/smart), never provider
+// or model identity. Vision never appears here — it is a capability lane, not a cost tier.
+//
+// `mainTier` is the tier the MAIN session actually runs on (resolveMainTier; null = unknown).
+//  - main is not smart (or unknown): legacy behavior — `code` is the silent default lane,
+//    lite/smart get a hand-off.
+//  - main is smart (UKit's default orchestrator): the smart lane is silent. A code lane is
+//    dispatched to its Tier 2 worker only where delegationPolicy admits it; `disallow` lanes
+//    (tiny-fix/local-fix) stay inline because the hand-off costs more than the work, and
+//    `disallow-by-default` (local-build) delegates only for multi-file / long edit loops.
+export const TIER_WORKER_AGENT = { lite: 'ukit-small-task-maintainer', code: 'feature-implementer' };
+
+// @decision-point orchestration.tier-lane-dispatch — deterministic choice of who performs the edit
+// (worker hand-off vs inline) from tier, main tier, delegation policy and risk; regression:
+// tests/orchestration/tierRiskIndependence.test.js, mainTierLane.test.js.
+export function buildTierLane({ modelTier = null, escalatedTier = null, mainTier = null, mainTierSource = null, delegationPolicy = null, executionMode = null, complexityHigh = false, riskHigh = false, playbookId = null, subagentSession = false } = {}) {
+  const tier = escalatedTier ?? modelTier;
+  if (!tier || tier === 'vision') {
+    return null;
+  }
+  // A host-marked subagent session IS the worker: it executes the brief it was handed. Handing the
+  // same brief onward (or requiring a delegation it cannot make) would nest orchestration — omp runs
+  // the router in child sessions too (live: child session routed with mainTier smart).
+  if (subagentSession) {
+    return { tier, mainTier: null, mainTierSource: 'subagent-session', defaultLane: true, executorTier: tier, instruction: null, subagentSession: true };
+  }
+  // Effort is independent of tier and of risk: Medium unless complexity evidence (verified failure /
+  // stuck) says High. The per-task effort can only be bound on a dispatch (Agent tool `effort` / omp
+  // task effort); the running session's own effort is never changed mid-task, so an inline lane
+  // records the High need as unbound.
+  const effort = complexityHigh ? 'high' : null;
+  const withEffort = (instruction) => (instruction && effort
+    ? `${instruction} Complexity evidence is high: pass effort="high" on that Agent/task call.`
+    : instruction);
+  const effortFields = effort ? { effort, effortBinding: 'dispatch-param-only' } : {};
+  if (mainTier !== 'smart') {
+    return {
+      tier,
+      defaultLane: tier === 'code',
+      instruction: tier === 'code'
+        ? null
+        : withEffort(`Hand this task to an agent bound to the ${tier} tier instead of doing it inline, unless this session already runs on the ${tier} tier.`),
+      ...effortFields,
+    };
+  }
+  const policy = delegationPolicy ?? 'allow-qualified-sidecar';
+  const brief = 'Give the worker scope, dependencies, acceptance criteria and the verification to run; verify its diff yourself after it returns, then run the project\'s bare test runner yourself (e.g. `npm test`, no pipe/tail/grep/compound command) and read its exit status — that status is the verification evidence.';
+  // A high-risk target on a Tier 2 coding lane is still Tier 2 work: the inline-by-policy exemption
+  // (hand-off costs more than the work) does not apply, otherwise the Tier 3 orchestrator would be the
+  // one editing the dangerous file. Risk raises verification rigor, not the executor.
+  if (tier === 'code' && riskHigh && (policy === 'disallow' || policy === 'disallow-by-default')) {
+    const worker = executionMode === 'find-cause' ? 'bug-debugger' : TIER_WORKER_AGENT.code;
+    return {
+      tier, mainTier, mainTierSource, defaultLane: false, executorTier: 'code', delegationRequired: true, ...effortFields,
+      instruction: withEffort(`High-risk target: hand the implementation to a code-tier worker (${worker}) instead of editing inline; this session runs on the smart tier. ${brief}`),
+    };
+  }
+  // A routed feature-implementation playbook is the contract-bearing / multi-surface build path, not a
+  // small local edit: the inline-by-policy exemption (hand-off costs more than the work) belongs to
+  // small-feature, so the Tier 3 orchestrator hands this implementation to the Tier 2 worker.
+  if (tier === 'code' && playbookId === 'feature-implementation' && policy === 'disallow-by-default') {
+    return {
+      tier, mainTier, mainTierSource, defaultLane: false, executorTier: 'code', delegationRequired: true, ...effortFields,
+      instruction: withEffort(`Feature-implementation playbook: hand the implementation to a code-tier worker (${TIER_WORKER_AGENT.code}) instead of editing inline; this session runs on the smart tier. ${brief}`),
+    };
+  }
+  // executorTier = the tier that actually performs the edit: the worker's when a hand-off is
+  // instructed, the main session's when the lane stays inline (an inline lane under a smart main is
+  // Tier 3 work), null when the hand-off is conditional on edit size.
+  const base = { tier, mainTier, mainTierSource, defaultLane: tier === 'smart', ...effortFields };
+  // Failure evidence escalated a coding lane to smart: the orchestrator takes the analysis, not the edit.
+  // Where delegation is admitted it still hands the implementation to the Tier 2 worker with its diagnosis.
+  if (tier === 'smart' && modelTier === 'code' && policy !== 'disallow' && policy !== 'disallow-by-default') {
+    const worker = executionMode === 'find-cause' ? 'bug-debugger' : TIER_WORKER_AGENT.code;
+    return {
+      ...base,
+      defaultLane: false,
+      executorTier: 'code',
+      delegationRequired: true,
+      instruction: withEffort(`Repeated failure evidence escalated this task: do the root-cause analysis yourself, then hand the implementation to a code-tier worker (${worker}) with your diagnosis instead of editing inline. ${brief}`),
+    };
+  }
+  if (tier === 'smart' || policy === 'disallow') {
+    return { ...base, executorTier: mainTier, instruction: null };
+  }
+  const worker = executionMode === 'find-cause' && tier === 'code' ? 'bug-debugger' : TIER_WORKER_AGENT[tier];
+  return {
+    ...base,
+    executorTier: policy === 'disallow-by-default' ? null : tier,
+    ...(policy === 'disallow-by-default' ? {} : { delegationRequired: true }),
+    instruction: withEffort(policy === 'disallow-by-default'
+      ? `Work inline unless the change spans several files or needs a long edit loop; then hand it to a ${tier}-tier worker (${worker}). ${brief}`
+      : `Hand the implementation to a ${tier}-tier worker (${worker}) instead of doing it inline; this session runs on the smart tier. ${brief}`),
+  };
+}
+
+const MODEL_TIER_ALIASES = [
+  [/opus|unic-smart|^slow$|^smart$/, 'smart'],
+  [/sonnet|unic-code|^default$|^code$/, 'code'],
+  [/haiku|unic-lite|^smol$|^lite$/, 'lite'],
+];
+
+/** Maps a model alias/id/role to lite|code|smart (config modelTiers first, then name families). */
+export function classifyModelTier(model, config = null) {
+  const value = typeof model === 'string' ? model.trim().toLowerCase().replace(/\[[^\]]*\]$/, '').replace(/:(off|minimal|low|medium|high|xhigh|max|auto)$/, '') : '';
+  if (!value) {
+    return null;
+  }
+  const tiers = config?.orchestration?.modelTiers;
+  for (const name of ['lite', 'code', 'smart']) {
+    const entry = tiers?.[name];
+    if (entry && [entry.claudeModel, entry.genericModel, entry.ompRole].some((v) => typeof v === 'string' && v.toLowerCase() === value)) {
+      return name;
+    }
+  }
+  const bare = value.includes('/') ? value.slice(value.lastIndexOf('/') + 1) : value;
+  return MODEL_TIER_ALIASES.find(([re]) => re.test(bare))?.[1] ?? null;
+}
+
+function readJsonFileSync(file) {
+  try {
+    return JSON.parse(fsSync.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Tier of the MAIN session, with provenance: {tier, source}. Host-selected model first
+ * (Claude Code: ANTHROPIC_MODEL > settings.local.json > settings.json `model`; OMP: the model the
+ * bridge recorded at session_start), then orchestration.orchestratorModel. Unknown → {tier:null}
+ * so buildTierLane keeps the legacy behavior. Never infers a model from anything else.
+ */
+export function resolveMainTier({ rootDir = null, config = null, env = process.env, sessionId = null } = {}) {
+  const candidates = [];
+  if (env?.UKIT_HARNESS === 'codex') {
+    return { tier: null, source: 'unknown' }; // codex cannot bind a model; never guess its main tier
+  }
+  if (env?.UKIT_HARNESS === 'omp') {
+    const recorded = rootDir ? readJsonFileSync(path.join(rootDir, '.ukit', 'storage', 'cache', 'session-main-model.json')) : null;
+    // STRICT ownership: the record is a single per-project slot describing ONE main session
+    // (the omp bridge stamps the writer's host session id). Without the caller's host session
+    // id — or with a record that is unstamped (a pre-provenance/legacy write) or owned by a
+    // DIFFERENT session — the OMP main tier is UNKNOWN: never read a foreign slot, and never
+    // fall through to the Claude orchestrator default on another session's data. The omp bridge
+    // refreshes the owner's record on session_start/session_switch/before_agent_start
+    // (observed-active-model-changed), so a matched owner sees current state, not a stale role.
+    const owned = recorded?.harness === 'omp'
+      && typeof sessionId === 'string' && sessionId !== ''
+      && typeof recorded.session === 'string' && recorded.session !== ''
+      && recorded.session === sessionId;
+        // OMP result owns the answer end-to-end: never fall through to the Claude
+    // orchestrator default on top of (or instead of) this harness's own record.
+    return { tier: classifyModelTier(owned ? (recorded.role ?? recorded.model) : null, config), source: owned ? 'omp-session' : 'unknown' };
+  } else {
+    candidates.push(['env:ANTHROPIC_MODEL', env?.ANTHROPIC_MODEL]);
+    for (const file of ['settings.local.json', 'settings.json']) {
+      candidates.push([`.claude/${file}`, rootDir ? readJsonFileSync(path.join(rootDir, '.claude', file))?.model : null]);
+    }
+  }
+  candidates.push(['orchestration.orchestratorModel', config?.orchestration?.orchestratorModel]);
+  for (const [source, model] of candidates) {
+    const tier = classifyModelTier(model, config);
+    if (tier) {
+      return { tier, source };
+    }
+  }
+  return { tier: null, source: 'unknown' };
+}
+
+/**
+ * Attaches `tierLane` to a route summary from the final route fields. Shared by the route CLI and the
+ * UserPromptSubmit hook so both persist the same delegation requirement; the Stop-side playbook
+ * acceptance reads `tierLane.delegationRequired` from that persisted state.
+ */
+export function applyTierLaneToRouteSummary(routeSummary, { rootDir = null, config = null, env = process.env, complexityHigh = false, subagentSession = false, sessionId = null } = {}) {
+  if (!routeSummary || typeof routeSummary !== 'object') {
+    return routeSummary;
+  }
+  const mainTier = resolveMainTier({ rootDir, config, env, sessionId });
+  routeSummary.tierLane = buildTierLane({
+    modelTier: routeSummary.executionContract?.modelTier ?? routeSummary.execution?.modelTier ?? null,
+    escalatedTier: routeSummary.escalatedTier ?? null,
+    mainTier: mainTier.tier,
+    mainTierSource: mainTier.source,
+    delegationPolicy: routeSummary.executionContract?.delegationPolicy ?? null,
+    executionMode: routeSummary.executionMode ?? null,
+    complexityHigh,
+    riskHigh: routeSummary.riskFloor?.floor === 'high-risk',
+    playbookId: routeSummary.playbookId ?? null,
+    subagentSession: subagentSession === true,
+  });
+  return routeSummary;
+}

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -82,7 +82,9 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
   const hasOutputField = typeof response === 'string' || typeof response?.stdout === 'string' || typeof response?.output === 'string';
   let role = null; let proven = false; let target = null; let remoteSync = null;
   for (const seg of real) {
-    if (!seg || /^cd\s+\S+$/.test(seg) || DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))) continue;
+    // `git diff --check` is a real verification, not a dry-run mutation.
+    if (!seg || /^cd\s+\S+$/.test(seg) || (DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))
+      && !(domain === 'git-integrity' && /^git\s+diff\s+--check(?:\s|$)/.test(seg)))) continue;
     if (domain === 'git-integrity') {
       const lsRemote = seg.match(GIT_LS_REMOTE);
       if (lsRemote) {