@on-par/factory-cli 0.9.1 → 0.9.3

package/dist/cli/index.js

@@ -2,14 +2,14 @@ import { fileURLToPath } from 'node:url';
 // packages/cli/src/cli/index.ts — CLI entry point: factory <command> [options]
 import { exec as execCb, execSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { createRequire } from 'node:module';
 import { arch, hostname as osHostname, release, platform, userInfo } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { promisify, styleText } from 'node:util';
 import { BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION, BRANCH_PREFIX_OPTION_DESCRIPTION, INVALID_BRANCH_PREFIX_MESSAGE, resolveBranchPrefixOption, } from './branch-prefix.js';
-import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
-import { acquirePidFile, createPlanReuseStore, checkBaseHealth, currentSlice, egressSummaryMessage, findSlicePlanComment, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, setupWorktree, shellEscape, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, } from '@on-par/factory-core/internal';
+import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
+import { acquirePidFile, createPlanReuseStore, checkBaseHealth, currentSlice, egressSummaryMessage, findSlicePlanComment, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, } from '@on-par/factory-core/internal';
 import { runTui } from '@on-par/factory-tui';
 import { Command } from 'commander';
 import { admissionStateReaderFor, runQueueReconcile } from './admission.js';
@@ -27,15 +27,15 @@ import { buildStatusUpdateJson, formatUpdateStartupLine, formatUpdateStatusLine,
 import { buildStopResumeJson } from './stop-resume-json.js';
 import { buildUsageJson } from './usage-json.js';
 import { parseResetIssues, runReset } from './reset.js';
-import { cmdDaemonLogs, cmdDaemonStart, cmdDaemonStatus, cmdDaemonStop, DaemonCtlError, detectInstall, loadDaemonFileConfig, resolveFactorydConfig, } from './daemon.js';
-import { cmdSelfUpdateCheck } from './self-update.js';
-import { analyzeEventLog, claudeKeychainCheck, doctorFailed, eventLogCheck, formatClaimReconcileReport, formatContainerReconcileReport, formatDoctorChecks, formatMicroVmReconcileReport, formatReconcileReport, formatWorktreeReconcileReport, leaseChecks, keychainPreflightError, orphanContainerChecks, orphanMicroVmChecks, runDoctorChecks, sandboxClaudeAuthChecks, unmergedGreenPrChecks, } from './doctor.js';
+import { cmdDaemonLogs, cmdDaemonStart, cmdDaemonStatus, cmdDaemonStop, createAutoUpdateDeps, DaemonCtlError, detectInstall, loadDaemonFileConfig, recoverStaleDrain, resolveFactorydConfig, runAutoUpdateLoop, } from './daemon.js';
+import { checkForUpdate, cmdSelfUpdateCheck } from './self-update.js';
+import { analyzeEventLog, claudeKeychainCheck, doctorFailed, eventLogCheck, formatClaimReconcileReport, formatContainerReconcileReport, formatDoctorChecks, formatMicroVmReconcileReport, formatReconcileReport, formatWorktreeReconcileReport, declaredHarnessChecks, hasSandboxRuntime, leaseChecks, keychainPreflightError, orphanContainerChecks, orphanMicroVmChecks, runDoctorChecks, sandboxAuthSkipDetail, sandboxClaudeAuthChecks, unmergedGreenPrChecks, } from './doctor.js';
 import { DOCS_URL, formatOverview, missingClaudeCliMessage, missingTokenMessage, notInitializedMessage, } from './first-run.js';
 import { cmdHostedSmoke } from './hosted.js';
 import { cmdHostedQueue } from './hosted-queue.js';
 import { cmdHostedRunner } from './hosted-runner.js';
 import { resolveFactoryCheckoutCommit, runFilingPreview } from './filing.js';
-import { buildFeedbackDeps, runFeedback } from './feedback.js';
+import { buildFeedbackDeps, resolveFeedbackRepo, runFeedback } from './feedback.js';
 import { ensureFactoryExcluded, writeSampleQueue } from './init-files.js';
 import { cmdLogs } from './logs.js';
 import { applyHelpGroups } from './help-groups.js';
@@ -144,6 +144,7 @@ const DEFAULT_CORE_OPS = {
     watchUsage,
     fetchSubscriptionUsage,
     diagnoseModels,
+    probeDeclaredHarnesses,
     writeLocalRunReport,
 };
 /** factory-core classes/ops for the current main() invocation; DEFAULT_CORE_OPS outside it. */
@@ -162,6 +163,7 @@ function resolveCoreOps(overrides, base = coreOps) {
         watchUsage: overrides.watchUsage ?? base.watchUsage,
         fetchSubscriptionUsage: overrides.fetchSubscriptionUsage ?? base.fetchSubscriptionUsage,
         diagnoseModels: overrides.diagnoseModels ?? base.diagnoseModels,
+        probeDeclaredHarnesses: overrides.probeDeclaredHarnesses ?? base.probeDeclaredHarnesses,
         writeLocalRunReport: overrides.writeLocalRunReport ?? base.writeLocalRunReport,
     };
 }
@@ -297,8 +299,14 @@ function writeIfAbsent(path, content, label, force = false) {
 }
 /** One-line onboarding reachability summary, e.g. "policy=auto, 3/7 models reachable". */
 export function formatInitReachability(diagnoses) {
+    return `policy=auto, ${formatReachabilityCount(diagnoses)}`;
+}
+/** Shared "K/N models reachable[, U unverified (no auth evidence)]" count for init and models --doctor. */
+export function formatReachabilityCount(diagnoses) {
     const reachable = diagnoses.filter((d) => d.reachable).length;
-    return `policy=auto, ${reachable}/${diagnoses.length} models reachable`;
+    const unverified = diagnoses.filter((d) => !d.reachable && d.unverified).length;
+    const base = `${reachable}/${diagnoses.length} models reachable`;
+    return unverified > 0 ? `${base}, ${unverified} unverified (no auth evidence)` : base;
 }
 async function cmdInit(opts = {}) {
     const repoRoot = await getRepoRoot();
@@ -321,15 +329,17 @@ async function cmdInit(opts = {}) {
     const constitutionPath = resolve(paths.root, 'constitution.md');
     const gitignorePath = resolve(paths.root, '.gitignore');
     writeIfAbsent(configPath, buildInitConfig(configPath.endsWith('.json') ? 'json' : 'yaml'), `.factory/${basename(configPath)}`, force);
-    // Constitution scaffold: repo directory basename fills <product-name>/<Product>.
-    const repoName = basename(repoRoot);
-    const template = readFileSync(resolve(configLoaders.getConstitutionsDir(), '_template.md'), 'utf-8');
-    writeIfAbsent(constitutionPath, scaffoldConstitution(template, repoName), '.factory/constitution.md', force);
+    // Constitution scaffold: the active product's bundled file, else the default-code constitution.
+    const constitutionsDir = configLoaders.getConstitutionsDir();
+    const active = readActiveProduct(paths.product);
+    const activeFile = active ? resolve(constitutionsDir, `${active}.md`) : undefined;
+    const source = activeFile && existsSync(activeFile) ? activeFile : resolve(constitutionsDir, 'default-code.md');
+    writeIfAbsent(constitutionPath, readFileSync(source, 'utf-8'), '.factory/constitution.md', force);
     writeIfAbsent(gitignorePath, 'state/\n', '.factory/.gitignore', force);
     // Doctor-style validation (policy=auto, N models reachable) — informational, never fails init.
     const modelsConfig = applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot));
     const registry = new coreOps.ModelRegistry(modelsConfig);
-    const diagnoses = coreOps.diagnoseModels(registry, {}, resolveExperimental(), resolveLocalOnly());
+    const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes(), resolveExperimental(), resolveLocalOnly());
     console.log(formatInitReachability(diagnoses));
     if (!hasReachableWorker(diagnoses)) {
         console.log(styleText('yellow', 'No worker model reachable yet — see `factory doctor` and `factory models --doctor`.'));
@@ -491,10 +501,34 @@ export async function runFeedbackCommand(prUrl, opts, deps, log = console.log) {
         throw err;
     }
 }
+/** owner/name of the checkout's origin remote, or null when there is none or it is not a GitHub remote. Never throws. */
+export async function readOriginSlug(shell = shellOps) {
+    try {
+        const { stdout } = await shell.exec('git remote get-url origin');
+        return parseRemoteSlug(stdout.trim());
+    }
+    catch {
+        return null;
+    }
+}
 export async function cmdFeedback(prUrl, opts) {
     const paths = getFactoryPaths(await getRepoRoot());
     const prefix = opts.branchPrefix === undefined ? resolveBranchPrefix() : branchPrefixOrExit(opts.branchPrefix);
-    await runFeedbackCommand(prUrl, opts, buildFeedbackDeps(getOctokit(), paths, prefix, createOctokitFilingClient));
+    let repo;
+    try {
+        repo = resolveFeedbackRepo({
+            flag: opts.repo,
+            config: configLoaders.loadFactoryConfigForRepo(paths.config).filing.repo,
+            remote: await readOriginSlug(),
+        });
+    }
+    catch (err) {
+        throw new CliExitError(err instanceof Error ? err.message : String(err), 2);
+    }
+    await runFeedbackCommand(prUrl, opts, buildFeedbackDeps(getOctokit(), paths, prefix, createOctokitFilingClient, {
+        repo,
+        shareLocal: opts.includeLocalPaths === true,
+    }));
 }
 async function resolveFactoryCommit() {
     return resolveFactoryCheckoutCommit(dirname(fileURLToPath(import.meta.url)), async (cmd, cwd) => (await shellOps.exec(cmd, { cwd })).stdout);
@@ -580,6 +614,40 @@ export function scaffoldConstitution(template, product) {
         .join(' ');
     return skeleton.replaceAll('<product-name>', JSON.stringify(product)).replaceAll('<Product>', display);
 }
+/**
+ * True when `existing` is an untouched scaffold: byte-identical (CRLF and trailing whitespace
+ * normalised) to a bundled constitution or to the legacy `_template.md` scaffold for `repoName`.
+ * Exact equality only — an edited file is never treated as a scaffold.
+ */
+export function isUnmodifiedConstitutionScaffold(existing, constitutionsDir, repoName) {
+    const norm = (s) => s.replace(/\r\n/g, '\n').trimEnd();
+    const target = norm(existing);
+    if (target === '')
+        return true;
+    let names = [];
+    try {
+        names = readdirSync(constitutionsDir).filter((f) => f.endsWith('.md') && !f.startsWith('_'));
+    }
+    catch {
+        // unreadable dir: no bundled files to compare against
+    }
+    for (const f of names) {
+        try {
+            if (norm(readFileSync(resolve(constitutionsDir, f), 'utf-8')) === target)
+                return true;
+        }
+        catch {
+            // skip unreadable entries
+        }
+    }
+    try {
+        const template = readFileSync(resolve(constitutionsDir, '_template.md'), 'utf-8');
+        return norm(scaffoldConstitution(template, repoName)) === target;
+    }
+    catch {
+        return false;
+    }
+}
 export async function cmdConstitution(opts, deps = {}) {
     const loader = new (resolveCoreOps(deps).ConstitutionLoader)();
     if (typeof opts.init === 'string' || opts.init === true) {
@@ -610,8 +678,21 @@ export async function cmdConstitution(opts, deps = {}) {
     }
     if (opts.list) {
         const products = loader.listProducts();
-        for (const p of products)
-            console.log(`  ${p}`);
+        for (const p of products) {
+            try {
+                const checkers = loader.load(p).checkers.join(', ');
+                console.log(`  ${p} — ${checkers || '(no checkers)'}`);
+            }
+            catch {
+                console.log(`  ${p}`);
+            }
+        }
+        return;
+    }
+    if (opts.checkers) {
+        for (const c of listBuiltInCheckers())
+            console.log(`  ${c.name} — ${c.description}`);
+        console.log("  custom_<name> — agent-judged checker graded against the constitution body (declare it in the constitution's checkers list)");
         return;
     }
     if (opts.product) {
@@ -623,25 +704,33 @@ export async function cmdConstitution(opts, deps = {}) {
         const paths = getFactoryPaths(repoRoot);
         ensureDir(paths.root);
         const constitutionPath = resolve(paths.root, 'constitution.md');
-        if (existsSync(constitutionPath) && !opts.force) {
+        const constitutionsDir = configLoaders.getConstitutionsDir();
+        const scaffold = existsSync(constitutionPath) &&
+            isUnmodifiedConstitutionScaffold(readFileSync(constitutionPath, 'utf-8'), constitutionsDir, basename(repoRoot));
+        if (existsSync(constitutionPath) && !opts.force && !scaffold) {
             throw new CliExitError('.factory/constitution.md already exists — use --force to overwrite', 1);
         }
-        const content = readFileSync(resolve(configLoaders.getConstitutionsDir(), `${opts.product}.md`), 'utf-8');
-        writeIfAbsent(constitutionPath, content, '.factory/constitution.md', opts.force);
+        const content = readFileSync(resolve(constitutionsDir, `${opts.product}.md`), 'utf-8');
+        writeIfAbsent(constitutionPath, content, '.factory/constitution.md', opts.force || scaffold);
         ensureDir(paths.state);
         writeFileSync(paths.product, opts.product);
         console.log(styleText('green', `Active product: ${opts.product}`));
         return;
     }
-    throw new CliExitError('usage: factory constitution --init <product> | --list | --product <name>', 2);
+    throw new CliExitError('usage: factory constitution --init <product> | --list | --checkers | --product <name>', 2);
+}
+/** Single owner of the per-model status icon, shared by `factory models` and `models --doctor` (#2402). */
+export function modelStatusIcon(d) {
+    return d.reachable ? styleText('green', '✅') : d.unverified ? styleText('yellow', '⚠️') : styleText('red', '❌');
 }
 export function formatDoctorReport(diagnoses) {
     const lines = [styleText('bold', '\n== Model Doctor ==')];
     for (const d of diagnoses) {
-        const icon = d.reachable ? styleText('green', '✅') : styleText('red', '❌');
+        const icon = modelStatusIcon(d);
         const tiers = d.tiers.join('/');
         lines.push(`  ${icon} ${d.model} provider=${d.provider} tier=${tiers} — ${d.reason}`);
     }
+    lines.push(`  ${formatReachabilityCount(diagnoses)}`);
     return lines.join('\n');
 }
 export function hasReachableWorker(diagnoses) {
@@ -660,17 +749,23 @@ function ollamaModelSet() {
         return undefined;
     }
 }
+/** Probes shared by every doctor-style reachability check (init, models --doctor, overnight
+ *  preflight), so their counts agree. */
+export function modelDoctorProbes() {
+    const ollamaModels = ollamaModelSet();
+    return {
+        commandAvailable: coreOps.isCommandAvailable,
+        ollamaModelPresent: ollamaModels ? (model) => ollamaModels.has(model) : undefined,
+    };
+}
 async function cmdModels(opts = {}) {
     const repoRoot = await getRepoRoot();
     const modelsConfig = applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot));
     const registry = new coreOps.ModelRegistry(modelsConfig);
     const allowExperimental = resolveExperimental();
     const localOnly = resolveLocalOnly();
+    const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes(), allowExperimental, localOnly);
     if (opts.doctor) {
-        const ollamaModels = ollamaModelSet();
-        const diagnoses = coreOps.diagnoseModels(registry, {
-            ollamaModelPresent: ollamaModels ? (model) => ollamaModels.has(model) : undefined,
-        }, allowExperimental, localOnly);
         console.log(formatDoctorReport(diagnoses));
         if (!hasReachableWorker(diagnoses)) {
             throw new CliExitError('factory: no worker model is reachable — fix the reasons above before running a queue', 1);
@@ -678,12 +773,13 @@ async function cmdModels(opts = {}) {
         return;
     }
     console.log(styleText('bold', '\n== Available Models =='));
+    const byModel = new Map(diagnoses.map((d) => [d.model, d]));
     for (const m of registry.list()) {
         const tiers = registry.getTiers(m).join('/');
         const est = registry.estimateCost(m, 1_000_000, 1_000_000);
         const cost = est === null ? 'unpriced' : `$${est.toFixed(2)}/M`;
-        const gated = registry.isExperimental(m) && !allowExperimental;
-        const avail = !gated && registry.isAvailable(m) ? styleText('green', '✅') : styleText('red', '❌');
+        const d = byModel.get(m);
+        const avail = d ? modelStatusIcon(d) : styleText('red', '❌');
         const tag = registry.isExperimental(m) ? styleText('yellow', ' [experimental]') : '';
         console.log(`  ${avail} ${m} tier=${tiers} ${cost}${tag}`);
     }
@@ -1663,6 +1759,7 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
         },
         localOnly: Boolean(ctx?.localOnly),
         blockUnresolvedRegressions: resolveDesignRegressionBlock(factoryConfig),
+        readinessUpdateIssueBody: resolveReadinessUpdateIssueBody(factoryConfig),
         publishFromBuild: resolveBuildPublish(factoryConfig),
         sizeGateMode,
         maxSlices,
@@ -1705,7 +1802,8 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
         resolveConstitution: () => 
         // Resolved once here — runIssue calls this exactly once and reuses the value for
         // every phase, so the build worker can never author the standards it is graded by.
-        constitutionLoader.resolve(worktree, product, factoryConfig.paths?.constitution),
+        // A local-only workspace is caller-provided, not a checkout of repoRoot, so it keeps its own constitution.
+        constitutionLoader.resolve(worktree, product, factoryConfig.paths?.constitution, ctx?.localOnly ? undefined : repoRoot),
         createApprovalGate: () => createFileApprovalGate({ dir: paths.approvals, timeoutMs: timeouts.approval * 1000 }),
         drainSteering: () => drainSteering(paths.steering, issueNum, worktree),
         reworkHistory,
@@ -2195,8 +2293,7 @@ async function cmdLocalSmallOvernight(opts) {
             if (!coreOps.isCommandAvailable('claude'))
                 return { ok: false, reason: missingClaudeCliMessage() };
             const registry = new coreOps.ModelRegistry(applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot)));
-            const ollamaModels = ollamaModelSet();
-            const diagnoses = coreOps.diagnoseModels(registry, { ollamaModelPresent: ollamaModels ? (m) => ollamaModels.has(m) : undefined }, resolveExperimental(), true);
+            const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes(), resolveExperimental(), true);
             if (!hasReachableWorker(diagnoses)) {
                 const reasons = diagnoses.filter((d) => !d.reachable).map((d) => `${d.model}: ${d.reason}`);
                 return { ok: false, reason: `no reachable local worker model — ${reasons.join('; ')}` };
@@ -2538,8 +2635,12 @@ async function cmdTriage(opts) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
-    const model = router.resolve('triage') ?? 'claude-sonnet-5';
-    const flag = router.registryRef.getClaudeFlag(model);
+    // Triage always runs `claude -p`, so only claude-cli models with a flag are runnable.
+    const registry = router.registryRef;
+    const resolved = router.resolveAll('triage');
+    const candidates = resolved.length > 0 ? resolved : ['claude-sonnet-5'];
+    const model = candidates.find((m) => registry.getHarnessId(m) === 'claude-cli' && registry.getClaudeFlag(m));
+    const flag = model ? registry.getClaudeFlag(model) : undefined;
     const constitutionNote = product ? `Active constitution: ${product}.` : '';
     const prompt = `Triage the open GitHub issues of ${ghRepo} for an autonomous software factory.
 ${constitutionNote}
@@ -2549,7 +2650,7 @@ and anything too vague. Group by lane (same-file issues together). Order by depe
 Write ONLY the queue to ${paths.queueProposed} in format '<lane> <issue#>', with '#' comments
 explaining exclusions.`;
     let plannerError;
-    logEvent(paths.events, 'triage', '-', `Triaging ${ghRepo} with ${model}`);
+    logEvent(paths.events, 'triage', '-', `Triaging ${ghRepo} with ${flag ?? 'claude default model'}`);
     await shellOps
         .exec(`claude -p ${shellEscape(prompt)} ${flag ? `--model ${flag}` : ''} --allowedTools "Bash(gh issue:*)" "Bash(gh repo:*)" Read Glob Grep Write`)
         .catch((err) => {
@@ -2960,7 +3061,19 @@ async function cmdFactoryd(opts) {
     for (const notice of config.notices)
         log(notice);
     const updateFile = updateStatePath(runtime.dir);
-    const updateState = initialUpdateState(config, readUpdateState(updateFile));
+    const previousUpdate = readUpdateState(updateFile);
+    for (const stop of recoverStaleDrain(previousUpdate, (file) => {
+        try {
+            unlinkSync(file);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    })) {
+        log(`update: removed stale STOP ${stop}`);
+    }
+    const updateState = initialUpdateState(config, previousUpdate);
     try {
         writeUpdateState(updateFile, updateState);
     }
@@ -2992,8 +3105,26 @@ async function cmdFactoryd(opts) {
         console.log(line);
     for (const line of banner)
         logSink(line);
+    let shuttingDown = false;
+    void runAutoUpdateLoop(config, {
+        ...createAutoUpdateDeps({
+            registryFile,
+            stateFile: updateFile,
+            cliEntrypoint: fileURLToPath(new URL('../cli.js', import.meta.url)),
+            check: () => checkForUpdate(config.autoUpdate.mode === 'prerelease' ? 'prerelease' : 'stable'),
+            runRuntime,
+            log,
+            exit: async (code) => {
+                await daemon.stop().catch(() => { });
+                await releaseRuntimeFiles(runtime);
+                process.exit(code);
+            },
+        }),
+        stopped: () => shuttingDown,
+    });
     await new Promise((resolveShutdown) => {
         const shutdown = () => {
+            shuttingDown = true;
             void daemon
                 .stop()
                 .catch(() => { })
@@ -4275,14 +4406,17 @@ async function cmdDoctor(opts = {}) {
     }
     let sandboxed = 'skipped';
     let sandboxDetail = 'skipped — host claude auth was not verified';
-    if (host === 'ok') {
-        const policy = repoRoot === null
-            ? undefined
-            : resolveSandboxPolicy(configLoaders.loadFactoryConfigForRepo(getFactoryPaths(repoRoot).config).sandbox, {
-                worktree: repoRoot,
-                repoRoot,
-                isAvailable: (cmd) => isCommandAvailableViaShell(shellOps, cmd),
-            });
+    const runtimeAvailable = hasSandboxRuntime(process.platform, (cmd) => isCommandAvailableViaShell(shellOps, cmd));
+    const skip = sandboxAuthSkipDetail({ runtimeAvailable, hostOk: host === 'ok', inRepo: repoRoot !== null });
+    if (skip !== null) {
+        sandboxDetail = skip;
+    }
+    else if (repoRoot !== null) {
+        const policy = resolveSandboxPolicy(configLoaders.loadFactoryConfigForRepo(getFactoryPaths(repoRoot).config).sandbox, {
+            worktree: repoRoot,
+            repoRoot,
+            isAvailable: (cmd) => isCommandAvailableViaShell(shellOps, cmd),
+        });
         if (!policy) {
             sandboxDetail = 'skipped — sandbox disabled by config or FACTORY_SANDBOX';
         }
@@ -4321,6 +4455,15 @@ async function cmdDoctor(opts = {}) {
         checks.push(stopSentinelCheck(readStopFileStatus(paths)));
         const eventsContent = existsSync(paths.events) ? readFileSync(paths.events, 'utf-8') : null;
         checks.push(eventLogCheck(eventsContent === null ? null : analyzeEventLog(eventsContent)));
+        let harnessProbes = [];
+        try {
+            const registry = new coreOps.ModelRegistry(applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot)));
+            harnessProbes = coreOps.probeDeclaredHarnesses(registry);
+        }
+        catch {
+            // models config problems are reported by `factory models --doctor`; doctor keeps going
+        }
+        checks.push(...declaredHarnessChecks(harnessProbes));
         // Full run-lifecycle reap (#998): dead-run worktrees and their branches. Uses the same
         // GitHub evidence and the same lock pairing as `factory worktree gc` (cmdWorktreeGc) —
         // a merged or closed PR is what makes a worktree reapable.
@@ -4493,8 +4636,9 @@ export async function main(argv = process.argv, deps = {}) {
         .command('constitution')
         .description('Manage product constitutions — .factory/constitution.md in this repo is the source of truth')
         .option('--init [product]', 'Write .factory/constitution.md in this repo, scaffolded from the template (an optional name overrides the display name)')
-        .option('--list', 'List available constitutions')
-        .option('--product <name>', 'Seed .factory/constitution.md from the bundled example constitution for <name>')
+        .option('--list', 'List available constitutions with their checkers')
+        .option('--checkers', 'List every built-in checker name with a one-line description')
+        .option('--product <name>', 'Seed .factory/constitution.md from the bundled constitution for <name>; replaces an unmodified scaffold without --force')
         .option('--force', 'With --init or --product, overwrite an existing .factory/constitution.md')
         .action((opts) => cmdConstitution(opts));
     program
@@ -4588,6 +4732,8 @@ export async function main(argv = process.argv, deps = {}) {
         .command('feedback <pr-url>')
         .description("File one factory issue (bug, factory:needs-triage) from a PR's human review findings")
         .option('--note <text>', 'Use this as the issue title instead of the first finding')
+        .option('--repo <owner/name>', 'Repo to file the issue in (default: filing.repo, then the origin remote)')
+        .option('--include-local-paths', 'Include this host name and local design/log paths in the issue')
         .option('--branch-prefix <prefix>', BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION)
         .action(cmdFeedback);
     const filingCmd = program.command('filing').description('Inspect upstream factory reports (nothing is sent)');