@reticlehq/server 3.5.0 → 3.7.0

package/dist/surface/tools/harness-explore.js

@@ -7,83 +7,35 @@
  * nothing grades) but the flows that now exist on disk, because every future run replays those
  * deterministically with no model in the loop at all.
  */
-import { ReticleEnv, ReticleTool, cloudUrlFrom, asRecord } from '@reticlehq/core';
+import { serverDriver, serverOptionsFromEnv } from '../../features/harness/platform/server-driver.js';
+import { exploreScript } from './harness-script.js';
+import { randomUUID } from 'node:crypto';
+import { harnessRunId, noteHarnessDisparity, noteHarnessGoal, noteHarnessSpan, } from '../../judgement/runs/drive-run.js';
+import { ReticleEnv, ReticleTool, asProjectId, asRecord } from '@reticlehq/core';
+import { flowsForSession } from '../../language/flows/flow-store-for-session.js';
 import { projectForRoot } from '../../memory/project/project-for-root.js';
-import { harnessDriver, harnessOptionsFromEnv, } from '../../features/harness/driver.js';
-import { fillValues } from '../../features/harness/fill-values.js';
-import { openFillValues } from '../../memory/project/dir/fill-value-store.js';
-import { ANTHROPIC_DRIVER_NAME, CUSTOM_DRIVER_NAME, DRIVER_NAMES, JEV_DRIVER_NAME, OPENAI_DRIVER_NAME, } from '../../features/harness/drivers.js';
-import { jevDriver, jevOptionsFromEnv } from '../../features/harness/jev-driver.js';
+import { actedOnApp, checkTally, pagesReached, typedValues, verdictLine, } from '../../features/harness/drive-report.js';
+import { CUSTOM_DRIVER_NAME, SERVER_DRIVER } from '../../features/harness/drivers.js';
 import { buildDomainModel } from '../../judgement/domain/domain-model.js';
 import { readContract } from '../../memory/project/dir/reticle-dir.js';
-import { sessionRoot } from '../../memory/project/session-root.js';
-import { buildHarnessPlan, planAsText } from './harness-plan.js';
-import { openAiDriver, openAiOptionsFromEnv, } from '../../features/harness/openai-driver.js';
-import { fetchPlatformConfig } from '../../features/harness/platform-config.js';
-import { DEFAULT_MAX_STEPS, runHarness, } from '../../features/harness/harness.js';
+import { sessionRoot, sessionTarget } from '../../memory/project/session-root.js';
+import { dashboardPlanUrl, dashboardRunUrl, readDashboardUrl, readLinkedProjectId, } from '../../memory/project/sync-status.js';
+import { buildHarnessPlan, drivingPlan, planAsText } from './harness-plan.js';
+import { allSessionIntents } from '../../memory/intent/open-intents.js';
+import { DEFAULT_MAX_STEPS, runHarness, StopReason, } from '../../features/harness/harness.js';
 import { reticleToolset } from './harness-toolset.js';
-import { secretEnvKey } from '../../language/flows/flows.js';
-/**
- * Why the harness is unavailable, phrased as the way to make it available.
- *
- * A missing key is a configuration fact, not a fault, and the sentence a user reads has to tell them
- * the one thing to do about it. Named here because both the CLI and the honest no-flows refusal
- * print it, and two copies of this sentence would drift.
- */
-export const MSG_NO_HARNESS_KEY = `No model configured to drive the app: set ${ReticleEnv.HARNESS_KEY}, or run \`reticle link\` and ` +
-    `set ${ReticleEnv.CLOUD_KEY}, to let Reticle explore it for you. Without either, flows are ` +
-    `recorded by your own coding agent through the MCP tools.`;
-/** Asked for Jev specifically and it is not configured. Distinct from having no model at all. */
-export const MSG_NO_JEV_KEY = `The \`${JEV_DRIVER_NAME}\` driver was asked for but is not configured: set ` +
-    `${ReticleEnv.HARNESS_JEV_KEY}, or run \`reticle link\` and set ${ReticleEnv.CLOUD_KEY}. ` +
-    `Refusing rather than quietly driving with another model, which would misattribute the result.`;
-/** Asked for OpenAI specifically and it is not configured. Never substituted, same as Jev. */
-export const MSG_NO_OPENAI_KEY = `The \`${OPENAI_DRIVER_NAME}\` driver was asked for but is not configured: set ` +
-    `${ReticleEnv.HARNESS_OPENAI_KEY}, or run \`reticle link\` and set ${ReticleEnv.CLOUD_KEY}. ` +
-    `Refusing rather than quietly driving with another model, which would misattribute the result.`;
-const msgUnknownDriver = (asked) => `Unknown harness driver \`${asked}\`. Known drivers: ${DRIVER_NAMES.join(', ')}.`;
-/**
- * The environment, plus the credential this machine already has.
- *
- * `reticle link` mints a project-scoped key and files it in `~/.reticle/credentials.json`; the CLI
- * has read it from there for as long as it has existed. The harness did not, and read only
- * `process.env` — so somebody who had signed in, linked their project and been told they were
- * connected still got "no model configured to drive the app", and the only way out was to find the
- * key in the console and export it by hand. Five manual steps to reach a feature they had already
- * finished setting up.
- *
- * Resolved into the env rather than threaded through four call sites: the drivers and the
- * preference lookup all read an env record, and giving them a completed one leaves each of them
- * exactly as simple as it was. The key precedence is the resolver's, the same as sync's and the
- * CLI's: the stored key for the link's host, else the exported one (which is how CI, with no
- * keystore, gets here). An explicitly exported HOST still wins, so a proxy is not overridden.
- *
- * The credential arrives through `deps.linkedCloud`, a port, because resolving it here would make
- * the tool surface reach into `memory/cloud` — a reach the directory guard refused, correctly.
- */
-export async function withLinkedCredential(deps, env) {
-    try {
-        const linked = await deps.linkedCloud?.();
-        if (linked === undefined || null === linked)
-            return env;
-        return {
-            ...env,
-            [ReticleEnv.API_KEY]: linked.apiKey,
-            [ReticleEnv.CLOUD_URL]: cloudUrlFrom(env) ?? linked.url,
-        };
-    }
-    catch {
-        // A credential store that cannot be read is "not linked", not an error. The harness is optional
-        // and its absence is a routine answer; a drive must never fail because a JSON file was odd.
-        return env;
-    }
-}
-/** Is there a model the harness can drive with? A read, because "not configured" is not a failure. */
-export function harnessAvailable(env) {
-    return (harnessOptionsFromEnv(env) !== undefined ||
-        jevOptionsFromEnv(env) !== undefined ||
-        openAiOptionsFromEnv(env) !== undefined);
-}
+import { DriveRefusedError, noteDriveLine } from '../../features/harness/drive-runs.js';
+import { personaCredentials } from '../../features/harness/platform/persona-credentials.js';
+import { endOf, goalOfDrive, parseGoals, readOpening, unprovedGoals, } from '../../features/harness/goals.js';
+import { mapForPlatform } from '../../features/harness/explore/site-map.js';
+import { huntAndGrade, knownRoutes, refreshMap, siteMapFor } from './harness-hunt.js';
+export { MSG_HARNESS_DISABLED, MSG_HARNESS_UNCLAIMED, MSG_HARNESS_UNCONFIRMED, } from '../../features/harness/platform/refusal.js';
+import { MSG_NO_HARNESS_KEY, refusedForPlan } from './harness-gate.js';
+// The gate a drive passes before it starts moved to its own module; its names are still asked for here.
+export { MSG_GATE_PROMPT_LEAD, MSG_NO_HARNESS_KEY, coverageRefusal, firstLine, harnessAvailable, harnessLockRefusal, refusedByPlatform, withLinkedCredential, } from './harness-gate.js';
+/** A driver named that this build no longer has: every Harness decision is the platform's now. */
+const msgUnknownDriver = (asked) => `The Harness driver \`${asked}\` is not available: the Harness runs on the Reticle platform, ` +
+    `which drives with the model set for the project in the dashboard.`;
 /**
  * Read the step ceiling out of the environment.
  *
@@ -106,52 +58,272 @@ export function maxStepsFromEnv(env) {
  * that says it saved a flow and did not is the same false green as an app that says it saved a
  * record and did not — and this product does not get to make that mistake about its own work.
  */
-export async function exploreApp(deps, env, options = {}) {
-    const refusal = await refusedByPlatform(env, options);
+export async function exploreApp(deps, given, asked = {}) {
+    // Every drive starts here. The credentials a persona names fill its sign-in fields on this
+    // machine, and only the redacted text travels on: to the platform, into flows and synced runs.
+    const named = asked.focus === undefined ? undefined : personaCredentials(asked.focus);
+    const env = named === undefined ? given : { ...given, ...named.secrets };
+    const options = named === undefined ? asked : { ...asked, focus: named.persona };
+    const refusal = await refusedForPlan(env, options);
     if (refusal !== undefined)
-        throw new Error(refusal);
+        throw new DriveRefusedError(refusal);
+    // The flows a drive reads and diffs are the PROJECT's, which is where its saves land.
+    const reads = withProjectFlows(deps, options.sessionId);
+    // No journey named: plan the drive first. The platform's Harness proposes the people worth being;
+    // the saved flows, the user's request and the unproved intents fill in the rest. The plan is drawn
+    // on the HUD and updated as each part runs.
+    const before = new Set(await reads.flows.list());
+    // Without a named journey the drive is always planned; with one, it is planned by the platform
+    // when there is one, and driven here as before when there is not.
+    if (options.focus === undefined ||
+        options.planId !== undefined ||
+        serverOptionsFromEnv(env) !== undefined) {
+        const scripted = await exploreScript(deps, env, options, before);
+        // Where the person opens it: the run, and the plan the dashboard keeps and runs again.
+        if (scripted !== undefined)
+            return {
+                ...scripted,
+                ...runUrlFor(deps, options.sessionId, scripted.runIds?.[0]),
+                ...planUrlFor(deps, options.sessionId, scripted.planId),
+            };
+    }
     const maxSteps = options.maxSteps ?? maxStepsFromEnv(env);
-    const before = new Set(await deps.flows.list());
     // `.reticle` FIRST, before the app and before anything reads a line of source. It already holds
     // every saved flow, the consequence that must hold for each, and the declared intent nobody has
     // tested — which is the whole of what a drive should be deciding against.
-    const plan = await readPlan(deps, options.sessionId);
-    /*
-     * The fixtures this project has already paid for.
-     *
-     * A drive is a sequence of DECISIONS and, occasionally, one COMPOSITION: what to type into a box
-     * whose label nothing can guess from. The cheap driver cannot write a string at all, so those
-     * boxes used to receive the words "reticle harness". This is the seam where a generating model
-     * answers instead -- for about 6% of steps, once per label, and never again on any later drive,
-     * because the answer is written into `.reticle` beside the flows that use it.
-     */
-    const fills = await openFillValues(deps.fs, safeRoot(deps, options.sessionId));
-    const requested = options.driverName ?? env[ReticleEnv.HARNESS_DRIVER] ?? (await preferredDriver(env, options));
+    const plan = await readPlan(reads, options.sessionId);
+    const driving = drivingPlan(plan, options.focus);
+    // Refused before anything touches the app: an unknown driver, or no platform to drive with.
+    if (options.driver === undefined)
+        buildDriver(env, maxSteps, driving, options.driverName, options.focus);
+    // Every action this drive takes carries who took it, so the run it folds into is the Harness's own
+    // and not mixed into the run of whichever agent shares the tab.
+    const harnessId = options.harnessId ?? randomUUID();
+    const driverLabel = options.driver === undefined ? SERVER_DRIVER : CUSTOM_DRIVER_NAME;
+    const toolset = reticleToolset(deps, {
+        ...pinned(options),
+        drivenBy: {
+            harness: harnessId,
+            driver: driverLabel,
+            ...(options.focus === undefined ? {} : { persona: options.focus }),
+        },
+        ...(options.focus === undefined ? {} : { asked: options.focus }),
+    });
+    const narrate = narrator(deps, options);
+    const invoke = (name, args) => toolset.invoke(name, args);
+    // Map first: survey the app (no model) unless this app's map is fresh, and leave the tab at start.
+    const map = await siteMapFor(deps, options.sessionId, invoke);
     const built = options.driver === undefined
-        ? buildDriver(env, maxSteps, plan, requested, fills)
+        ? buildDriver(env, maxSteps, driving, options.driverName, options.focus, undefined, map)
         : { driver: options.driver, name: CUSTOM_DRIVER_NAME };
     const driver = built.driver;
-    const toolset = reticleToolset(deps, pinned(options));
+    // Read before anything is driven: a goal this page already shows proves nothing at the end.
+    const opening = await readOpening(invoke);
+    narrate(`Harness is driving${options.focus === undefined ? '' : `: ${options.focus}`}`, true);
+    const driveStarted = deps.now();
     const drive = await runHarness(driver, toolset, {
+        ...steering(options),
         maxSteps,
+        routes: knownRoutes(map),
         // The plan rides in as standing instruction, so it is in front of the model on every turn
         // rather than remembered from a first one. `focus` is the caller's own words and goes last:
         // somebody who named a journey meant that journey, whatever the project's backlog says.
         focus: [
-            planAsText(plan),
+            planAsText(driving),
             ...(options.focus === undefined ? [] : [`Focus: ${options.focus}`]),
         ].join('\n\n'),
+        // The end the caller's words quote stops the drive once it shows: see HarnessOptions.endsAt.
+        ...((end) => end === undefined || options.focus === undefined
+            ? {}
+            : { endsAt: { text: end, own: [options.focus] } })(endOf(options.focus ?? '')),
     });
-    // Written once, after the drive, whatever the drive did: a run that broke still learned what it
-    // learned, and the next one should not pay for it again.
-    await fills.flush();
+    // Before the session ends and is graded: a drive whose goal was missed, or that was cut off part-way,
+    // must not sync as "Proved" on the checks that held before it stopped.
+    noteHarnessGoal(harnessId, drive.goalMet);
+    narrate(StopReason.STOPPED === drive.stopReason
+        ? `Autonomous driving switched off — the Harness stopped after ${String(drive.steps)} steps. What it drove is kept.`
+        : StopReason.BROKEN === drive.stopReason
+            ? msgDriveCutOff(drive.error)
+            : `Harness finished — ${verdictLine(checkTally(drive.toolCalls))}`, true);
     // MANDATORY, and deliberately outside the loop. A drive that runs out of budget mid-journey, or
     // breaks, or whose model simply stops asking for tools, leaves a recording open and everything it
     // drove unsaved — work paid for and thrown away. Saving is not a decision any model gets to make
     // and not something a step budget gets to cut off, so it happens here, after the loop, always.
-    await bankOpenRecording(toolset, drive);
-    const after = await deps.flows.list();
-    return { drive, plan, driverName: built.name, ...reconcileFlows(before, after, drive.toolCalls) };
+    const banked = await bankOpenRecording(toolset, drive, options.focus);
+    await refreshMap(deps, options.sessionId, map, drive.toolCalls);
+    // Hunt for the journey's end before grading: never a `no` from where the drive happened to stop.
+    const graded = await huntAndGrade(deps, invoke, {
+        sessionId: options.sessionId,
+        goals: options.goals ?? parseGoals(options.focus),
+        expect: options.expect,
+        opening,
+        journey: options.focus,
+        map,
+        reached: pagesReached(drive.toolCalls),
+        typed: typedValues(drive.toolCalls),
+    });
+    const goals = graded.goals;
+    noteHarnessDisparity(harnessId, graded.disparity);
+    // The goals it was given decide whether the journey was done, not a click that held on the way,
+    // and never the driver's word over a drive that did nothing.
+    const goalMet = goalOfDrive(drive.goalMet, goals, actedOnApp(drive.toolCalls));
+    noteHarnessGoal(harnessId, goalMet);
+    noteHarnessSpan(harnessId, deps.now() - driveStarted);
+    const unproved = unprovedGoals(goals);
+    if (unproved !== undefined)
+        narrate(unproved, true);
+    const after = await reads.flows.list();
+    const reconciled = reconcileFlows(before, after, [...drive.toolCalls, ...banked]);
+    if (options.focus !== undefined) {
+        await recordPersona(reads, [...reconciled.savedFlows, ...reconciled.rewroteFlows], options.focus);
+    }
+    const unverifiedFlows = await flowsThatCheckNothing(reads, [
+        ...reconciled.savedFlows,
+        ...reconciled.rewroteFlows,
+    ]);
+    const runId = harnessRunId(harnessId);
+    return {
+        // The hunt's navigations after the drive's own calls: they are the Harness driving the app too.
+        // After the goal is decided, which counts only what the drive itself did.
+        drive: {
+            ...drive,
+            toolCalls: [...drive.toolCalls, ...graded.moved],
+            ...(goalMet === undefined ? {} : { goalMet }),
+        },
+        plan,
+        driverName: built.name,
+        ...reconciled,
+        unverifiedFlows,
+        goals,
+        ...(0 === graded.disparity.length ? {} : { disparity: graded.disparity }),
+        ...(runId === undefined ? {} : { runIds: [runId] }),
+        ...runUrlFor(deps, options.sessionId, runId),
+    };
+}
+/** The stop and the words of whoever started the drive, for `runHarness`. */
+export function steering(options) {
+    return {
+        ...(options.stopped === undefined ? {} : { stopped: options.stopped }),
+        ...(options.inbox === undefined ? {} : { inbox: options.inbox }),
+    };
+}
+/** A line in the HUD's Agent Log for the person watching; nobody watching is not an error. */
+export function narrator(deps, options) {
+    return (text, summary = false) => {
+        // The drive's poll answers with its latest line, whether or not a tab is watching.
+        if (options.harnessId !== undefined)
+            noteDriveLine(options.harnessId, text);
+        try {
+            // Filed in the HUD's Harness log; its start and end lines in the Agent Log too.
+            deps.sessions
+                .resolve(options.sessionId)
+                .pushNarration(text, true, { harness: true, summary });
+        }
+        catch {
+            /* nobody is watching: the drive still runs */
+        }
+    };
+}
+/** The plan's page on the dashboard, where it is edited and run again; nothing when unlinked. */
+function planUrlFor(deps, sessionId, planId) {
+    if (planId === undefined)
+        return {};
+    try {
+        const root = sessionRoot(deps, sessionId);
+        const dashboard = readDashboardUrl(root);
+        return dashboard === undefined
+            ? {}
+            : {
+                planUrl: dashboardPlanUrl({
+                    dashboardUrl: dashboard,
+                    planId,
+                    projectId: readLinkedProjectId(root),
+                }),
+            };
+    }
+    catch {
+        return {};
+    }
+}
+/** The run's page on the dashboard, when the tab's project is linked; nothing when it is not. */
+function runUrlFor(deps, sessionId, runId) {
+    if (runId === undefined)
+        return {};
+    try {
+        const dashboard = readDashboardUrl(sessionRoot(deps, sessionId));
+        return dashboard === undefined ? {} : { runUrl: dashboardRunUrl(dashboard, runId) };
+    }
+    catch {
+        return {}; // no tab, no project: the run is still reported, without a link
+    }
+}
+export async function productRules(deps, sessionId) {
+    try {
+        return (await allSessionIntents(deps, sessionId)).map((intent) => intent.statement);
+    }
+    catch {
+        return [];
+    }
+}
+/** `deps` whose flow store is the session's own project, where the drive's saves land. */
+export function withProjectFlows(deps, sessionId) {
+    try {
+        return { ...deps, flows: flowsForSession(deps, sessionTarget(deps, sessionId)).flows };
+    }
+    catch {
+        return deps;
+    }
+}
+/**
+ * Write the persona onto every flow the drive saved or rewrote without an intent.
+ *
+ * Whichever driver saved it, and in whatever words: the cheap driver's own teardown saved its flow
+ * with no intent at all, so a replay could never say which journey it was meant to prove. A flow
+ * that already carries an intent keeps it. Best effort: a flow that cannot be read or rewritten is
+ * still a saved flow.
+ */
+export async function recordPersona(deps, names, persona) {
+    // Only the journey itself, "Name: journey": the plan appends the product's rules below it, and
+    // keeping them made each plan append them again to a goal that already carried them.
+    const intent = (persona.split('\n')[0] ?? '').trim();
+    if (0 === intent.length)
+        return;
+    for (const name of names) {
+        try {
+            const loaded = await deps.flows.load(name);
+            if (!loaded.ok || (loaded.value.intent ?? '').length > 0)
+                continue;
+            // Its own project: without it the store files a flat duplicate beside the original.
+            const project = loaded.value.projectId;
+            await deps.flows.saveFlow({ ...loaded.value, intent }, project === undefined ? undefined : asProjectId(project));
+        }
+        catch {
+            /* the flow stays as it was saved */
+        }
+    }
+}
+/**
+ * The saved flows with no step that asserts a consequence.
+ *
+ * Such a flow replays as "verified nothing": it clicks through the journey and would pass with the
+ * feature broken. Named so the drive's report does not count it as evidence. A flow that cannot be
+ * read is left out rather than guessed at.
+ */
+export async function flowsThatCheckNothing(deps, names) {
+    const empty = [];
+    for (const name of names) {
+        try {
+            const loaded = await deps.flows.load(name);
+            if (!loaded.ok)
+                continue;
+            if (!loaded.value.steps.some((step) => step.expect !== undefined))
+                empty.push(name);
+        }
+        catch {
+            /* unreadable is not the same as empty */
+        }
+    }
+    return empty;
 }
 /**
  * What a drive actually left behind, split into flows that are NEW and flows it wrote over.
@@ -183,117 +355,30 @@ export function reconcileFlows(before, after, toolCalls) {
         return 'string' === typeof flowName ? flowName : undefined;
     })
         .filter((name) => name !== undefined && present.has(name));
+    // Only what this drive's own saves wrote: a before/after diff of the project's flows claimed the
+    // flows other agents saved in the same project at the same time.
     return {
-        savedFlows: after.filter((name) => !before.has(name)),
+        savedFlows: [...new Set(claimed.filter((name) => !before.has(name)))],
         rewroteFlows: [...new Set(claimed.filter((name) => before.has(name)))],
     };
 }
 /**
- * The driver this project chose on the platform, if it chose one, we can reach it, and we have it.
- *
- * Only asked when nobody has been explicit, so the cost is paid exactly once per drive and never on
- * a path where it could not change the answer. An unreachable platform returns undefined and the
- * environment decides, exactly as it did before this lookup existed.
- *
- * A preference naming a driver this build does not have is IGNORED rather than refused, and that
- * asymmetry with the per-call argument is deliberate. The platform offers providers this daemon may
- * be too old to know about — it already offers `openai`, which has no binding here — so a stored
- * preference is a statement about the account, not an instruction for this drive, and a daemon that
- * refused to run because a web UI knew one more word than it does would be broken by its own
- * upgrade cycle. Naming a driver in the CALL is an instruction, and an unknown one is still an
- * error there.
- *
- * It is not a silent substitution either way: the result reports the driver that actually drove.
- */
-async function preferredDriver(env, options) {
-    if (true === options.skipPlatformConfig)
-        return undefined;
-    return knownDriver((await platformConfig(env, options))?.provider);
-}
-/**
- * What a person said about autonomous driving on the platform, honoured here.
- *
- * The switch existed, persisted and round-tripped, and the daemon read it and threw it away — so
- * turning the harness OFF changed a value in a database and nothing else. A control that does not
- * control anything is worse than no control: somebody turns it off, watches Reticle drive their app
- * anyway, and now correctly distrusts every other switch in the product.
- *
- * Absent means ON. The platform's own default is on, and a machine that cannot reach the platform —
- * offline, CI, no link — must not silently lose a feature it was never told to stop using.
- */
-export const MSG_HARNESS_DISABLED = 'Autonomous driving is turned OFF for this project. Turn it back on in the Reticle dashboard ' +
-    '(Settings → Verification model), or drive the app yourself through the MCP tools.';
-/**
- * The other reason a drive can be refused, and it is NOT the same reason.
- *
- * A drive through the platform spends Reticle's model budget. That is free for three months and
- * included on a paid plan, and outside both it is somebody else's money being spent on nothing. The
- * message says which of the two it is and what to do, because "the harness is off" told to a person
- * who never turned anything off is a support ticket rather than an answer.
- */
-export const MSG_HARNESS_UNCLAIMED = 'This workspace has no harness entitlement, so autonomous driving would run on Reticle’s model ' +
-    'budget with nothing paying for it. Claim the free 3 months in the Reticle dashboard, or export a ' +
-    'model API key of your own and drive with that.';
-/**
- * Whether a drive would be paid for by the person asking for it.
- *
- * Entitlement gates OUR spend, so it has no business stopping somebody who brought their own key:
- * their harness costs us nothing whether they ever claim anything or not. Reading the same options
- * the drivers read keeps the two answers from drifting apart.
- */
-function ownsAModelKey(env) {
-    // The DIRECT variables only. Every driver also accepts the platform key as a fallback, so asking
-    // `jevOptionsFromEnv` here would answer "they have a key" for exactly the person whose drive would
-    // be billed to us — which is the one case this gate exists for.
-    return [ReticleEnv.HARNESS_KEY, ReticleEnv.HARNESS_JEV_KEY, ReticleEnv.HARNESS_OPENAI_KEY].some((name) => {
-        const value = env[name];
-        return value !== undefined && 0 < value.length;
-    });
-}
-/** One read, however many questions are asked of the answer. */
-function platformConfig(env, options) {
-    return options.configFetch === undefined
-        ? fetchPlatformConfig(env)
-        : fetchPlatformConfig(env, options.configFetch);
-}
-/**
- * The reason this drive must not start, or `undefined` to go ahead.
- *
- * It FAILS OPEN, and that is worth stating plainly because the argument for it changed under it.
- * `fetchPlatformConfig` answers `undefined` on a network error, a non-2xx, a body that does not
- * parse, or a two-second timeout, and all four land here as "carry on". When this endpoint only
- * answered "which model does this project prefer", failing open cost nothing: the drive used the
- * environment and nobody was worse off. It now also answers "is anybody paying for this", and the
- * same silence means a drive runs on Reticle's model budget unmetered.
- *
- * Kept open anyway, deliberately: a settings endpoint having a slow second must not break somebody
- * mid-verification, and the exposure is one drive's worth of a very cheap model. But this is
- * best-effort, not enforcement -- if the spend needs a hard floor, it belongs at the proxy, which
- * is the only side that cannot be talked out of it by a dropped packet.
- */
-async function refusedByPlatform(env, options) {
-    if (true === options.skipPlatformConfig)
-        return undefined;
-    const config = await platformConfig(env, options);
-    if (config === undefined)
-        return undefined;
-    if (!config.harnessEnabled)
-        return MSG_HARNESS_DISABLED;
-    if (!config.harnessEntitled && !ownsAModelKey(env))
-        return MSG_HARNESS_UNCLAIMED;
-    return undefined;
-}
-/**
- * A stored preference, kept only if this build can actually honour it.
- *
- * Exported because it is the whole of the asymmetry with the per-call argument, and the asymmetry
- * is the part somebody will later think is a bug.
+ * Why a drive must not be replayed into a verdict, or undefined when it may. A drive the platform
+ * cut off (credits gone: 402 needs_card) had saved one partial flow, and replaying it printed PASS
+ * with no word about the credits. The one test both CLI explore paths answer through.
  */
-export function knownDriver(provider) {
-    if (provider === undefined)
+export function cutOffReason(drive) {
+    if (StopReason.BROKEN !== drive.stopReason && StopReason.STOPPED !== drive.stopReason)
         return undefined;
-    return DRIVER_NAMES.some((name) => name === provider) ? provider : undefined;
+    const why = 'string' === typeof drive.error && 0 < drive.error.length
+        ? drive.error
+        : StopReason.STOPPED === drive.stopReason
+            ? 'autonomous driving was switched off.'
+            : 'the drive broke.';
+    return `The drive stopped before it finished: ${why} Nothing was proved; what it saved stays, and the next run replays it.`;
 }
+/** The Agent Log's last line for a drive the platform cut off: its reason, and that it proved nothing. */
+export const msgDriveCutOff = (error) => `Harness stopped before it finished, so nothing is proved: ${error ?? 'the drive broke.'}`;
 /**
  * Close and save whatever recording the drive left open.
  *
@@ -306,19 +391,34 @@ export function knownDriver(provider) {
  * already closed the stop is refused and there is nothing to do, and a drive must not fail at the
  * finish line because the thing it was trying to rescue did not need rescuing.
  */
-async function bankOpenRecording(toolset, drive) {
+/**
+ * What a banked recording says it was for: the persona the caller named, when there was one.
+ *
+ * It used to be "Autonomous drive of X, banked after the run ended" whatever the caller asked for,
+ * so a replay could never say which journey the flow was meant to prove.
+ */
+export function bankedIntent(persona, open, 
+/** The journey the drive was for, when no persona was named. */
+journey) {
+    const named = (persona ?? journey)?.trim();
+    return named !== undefined && 0 < named.length
+        ? named
+        : `Exploring the app, recorded as ${open} and saved after the run ended.`;
+}
+export async function bankOpenRecording(toolset, drive, persona, journey) {
     const open = openRecordingName(drive.toolCalls);
     if (open === undefined)
-        return;
+        return [];
+    const args = { flowName: open, intent: bankedIntent(persona, open, journey) };
     try {
         await toolset.invoke(ReticleTool.RECORD, { action: 'stop', recordingName: open });
-        await toolset.invoke(ReticleTool.FLOW_SAVE, {
-            flowName: open,
-            intent: `Autonomous drive of ${open}, banked after the run ended.`,
-        });
+        const result = await toolset.invoke(ReticleTool.FLOW_SAVE, args);
+        // Returned so the save is this drive's own, as a save the model made is.
+        return [{ id: 'bank', name: ReticleTool.FLOW_SAVE, args, result, isError: false }];
     }
     catch {
         /* last chance, not a checkpoint */
+        return [];
     }
 }
 /** The recording started and never stopped, if there is one. Exported because it is the decision. */
@@ -345,14 +445,23 @@ export function openRecordingName(toolCalls) {
  * ordinary state of a new project and not a reason to refuse to drive — so it answers an empty
  * plan rather than throwing.
  */
-async function readPlan(deps, sessionId) {
+export async function readFlows(deps) {
+    const flows = [];
     try {
-        const flows = [];
         for (const name of await deps.flows.list()) {
             const loaded = await deps.flows.load(name);
             if (loaded.ok)
                 flows.push(loaded.value);
         }
+    }
+    catch {
+        // An unreadable store plans from what it could read, as `readPlan` does.
+    }
+    return flows;
+}
+export async function readPlan(deps, sessionId) {
+    try {
+        const flows = await readFlows(deps);
         const root = sessionRoot(deps, sessionId);
         const contract = await readContract(deps.fs, root);
         const project = await projectForRoot(deps, root).read();
@@ -366,93 +475,36 @@ async function readPlan(deps, sessionId) {
         };
     }
 }
-/**
- * The project directory, or nothing.
- *
- * `sessionRoot` needs a session and a project to answer, and a drive can legitimately be asked for
- * before either is resolvable. Everything else that reads `.reticle` here already treats that as
- * "no project record" rather than as a failure; the fixtures file is no different, and a throw on
- * this path would turn a missing directory into a refused drive.
- */
-function safeRoot(deps, sessionId) {
-    try {
-        return sessionRoot(deps, sessionId);
-    }
-    catch {
-        return undefined;
-    }
-}
-function pinned(options) {
+export function pinned(options) {
     return options.sessionId === undefined ? {} : { sessionId: options.sessionId };
 }
 /**
- * Pick the driver.
- *
- * The Anthropic driver stays the default, and an explicit `RETICLE_HARNESS_DRIVER=jev` is the only
- * thing that moves off it when both are configured — a driver change is a change in how the app gets
- * driven, and inferring one from which key happens to be exported would swap it under people who
- * merely linked their account.
- *
- * The fall-through is the other direction and is not a preference: with no Anthropic key and a
- * platform key present, Jev is not the cheaper option, it is the only one. Choosing it there is what
- * makes the harness work for somebody who never had a model API key of their own, which is most
- * people — and the reason this driver is worth having at all.
+ * The driver: the platform's Harness, which decides every step on its side while this machine
+ * executes. There is no other: the decisions, the models and the planning run only on the platform.
  */
-function buildDriver(env, maxSteps, plan, requested, fills) {
-    // The two halves of what `.reticle` knows, handed to the one driver that can use both: what is
-    // worth doing, and the names the app uses for what it does. The second is what lets a declared
-    // consequence be SAVED rather than merely proved; see `consequencesFor`.
-    const fromReticle = {
-        plan: plan.steps,
-        vocabulary: plan.vocabulary,
-        /*
-         * Generation is offered ONLY when a generating model is already configured, and it stays out of
-         * the per-turn loop either way: put a text model on every turn and you pay its per-turn tax on
-         * the 94% of steps that are clicks, which is the entire cost the cheap driver exists to avoid.
-         * With no such key the label heuristic answers, exactly as it did before this existed.
-         */
-        fillValue: fillValues({
-            secret: (label) => env[secretEnvKey(label)],
-            ...(fills === undefined ? {} : { cache: fills }),
-            // GPT first: a linked machine reaches it through the platform with no key of its own.
-            ...(openAiOptionsFromEnv(env) === undefined
-                ? {}
-                : { openai: openAiOptionsFromEnv(env) }),
-            ...(harnessOptionsFromEnv(env) === undefined
-                ? {}
-                : { generator: harnessOptionsFromEnv(env) }),
+export function buildDriver(env, maxSteps, plan, requested, persona, 
+/** A goal driven with no persona: it names the drive's flows as a persona would. */
+journey, 
+/** The survey of the app, which the platform's engine looks goals up in. */
+siteMap) {
+    if (requested !== undefined && SERVER_DRIVER !== requested)
+        throw new Error(msgUnknownDriver(requested));
+    const platform = serverOptionsFromEnv(env);
+    if (platform === undefined)
+        throw new Error(MSG_NO_HARNESS_KEY);
+    return {
+        driver: serverDriver({
+            ...platform,
+            ...(persona === undefined ? {} : { persona }),
+            ...(journey === undefined ? {} : { journey }),
+            plan: planAsText(plan),
+            planSteps: plan.steps,
+            vocabulary: plan.vocabulary,
+            maxSteps,
+            ...(siteMap === undefined ? {} : { siteMap: mapForPlatform(siteMap) }),
+            // Secret fields fill from the drive's own env: a persona's credentials ride in it.
+            env,
         }),
+        name: SERVER_DRIVER,
     };
-    const jev = jevOptionsFromEnv(env);
-    const anthropic = harnessOptionsFromEnv(env);
-    const asked = requested;
-    // A driver that was ASKED for and is not configured is an error, never a substitution. Quietly
-    // falling back would make every comparison between two drivers a possible lie about which one
-    // produced the result — and comparing them is the main reason anyone names one.
-    if (JEV_DRIVER_NAME === asked) {
-        if (jev === undefined)
-            throw new Error(MSG_NO_JEV_KEY);
-        // The Jev driver is told the budget because it has a teardown to reach; the Anthropic driver is
-        // not, because it calls `finish` itself and being handed a number it did not ask for is how a
-        // second copy of the budget starts drifting from the loop's.
-        return { driver: jevDriver({ ...jev, maxSteps, ...fromReticle }), name: JEV_DRIVER_NAME };
-    }
-    if (ANTHROPIC_DRIVER_NAME === asked) {
-        if (anthropic === undefined)
-            throw new Error(MSG_NO_HARNESS_KEY);
-        return { driver: harnessDriver(anthropic), name: ANTHROPIC_DRIVER_NAME };
-    }
-    if (OPENAI_DRIVER_NAME === asked) {
-        const openai = openAiOptionsFromEnv(env);
-        if (openai === undefined)
-            throw new Error(MSG_NO_OPENAI_KEY);
-        return { driver: openAiDriver(openai), name: OPENAI_DRIVER_NAME };
-    }
-    if (asked !== undefined && 0 < asked.length)
-        throw new Error(msgUnknownDriver(asked));
-    if (anthropic !== undefined)
-        return { driver: harnessDriver(anthropic), name: ANTHROPIC_DRIVER_NAME };
-    if (jev !== undefined)
-        return { driver: jevDriver({ ...jev, maxSteps, ...fromReticle }), name: JEV_DRIVER_NAME };
-    throw new Error(MSG_NO_HARNESS_KEY);
 }