@reticlehq/server 3.6.0 → 3.7.0

package/dist/surface/tools/harness-explore.d.ts

@@ -10,14 +10,26 @@
 import { type FlowFile } from '@reticlehq/core';
 import type { ToolDeps } from './tool-kit.js';
 import { type HarnessPlan } from './harness-plan.js';
-import { type ConfigFetch } from '../../features/harness/platform-config.js';
-import { type HarnessResult, type HarnessToolset, type ModelDriver, type ToolOutcome } from '../../features/harness/harness.js';
+import type { ConfigFetch } from '../../features/harness/platform-config.js';
+import type { JourneyResult } from '../../features/harness/platform/script.js';
+import { type HarnessOptions, type HarnessResult, type HarnessToolset, type ModelDriver, type ToolOutcome } from '../../features/harness/harness.js';
 import { type GoalCheck } from '../../features/harness/goals.js';
+import type { RunDisparity } from '@reticlehq/core';
+import type { HarnessMap } from '@reticlehq/core/artifacts';
+export { MSG_HARNESS_DISABLED, MSG_HARNESS_UNCLAIMED, MSG_HARNESS_UNCONFIRMED, } from '../../features/harness/platform/refusal.js';
+export { MSG_GATE_PROMPT_LEAD, MSG_NO_HARNESS_KEY, coverageRefusal, firstLine, harnessAvailable, harnessLockRefusal, refusedByPlatform, withLinkedCredential, } from './harness-gate.js';
 export interface ExploreOptions {
     /** Who to be, or what to accomplish. Appended to the standing instruction. */
     focus?: string;
+    /**
+     * A person started this run (Run plan from the dashboard) and acknowledged the saved flows' own
+     * destructive steps: a planned replay may take them. Never a step the model decides.
+     */
+    confirmDangerous?: boolean;
     /** Texts the drive must leave on the page. Default: whatever `focus` quoted. See goals.ts. */
     goals?: readonly string[];
+    /** The outcome the journey must end in, as a reticle_assert predicate. See `checkExpect`. */
+    expect?: Record<string, unknown>;
     /** Pinned tab, when the app has more than one connected. */
     sessionId?: string;
     /** Hard ceiling on model turns. Bounds cost, not value — the drive is usable however it ends. */
@@ -48,6 +60,14 @@ export interface ExploreOptions {
      * supposed to cover the OFF switch was asserting on a path where the platform is never asked.
      */
     configFetch?: ConfigFetch;
+    /** The drive's harness id, minted by the caller so its run id is known before the drive starts. */
+    harnessId?: string;
+    /** A plan the platform saved (`hp_…`): run it as it stands, instead of asking for a new one. */
+    planId?: string;
+    /** Asked between turns: whoever started the drive asked it to stop. */
+    stopped?: () => boolean;
+    /** Asked between turns: what whoever started the drive said to it since. */
+    inbox?: () => readonly string[];
 }
 export interface ExploreResult {
     drive: HarnessResult;
@@ -85,40 +105,17 @@ export interface ExploreResult {
     driverName: string;
     /** The run this drive syncs as (`harness-<id>`), so a caller can find it on the platform. */
     runIds?: readonly string[];
+    /** The run's page on the dashboard, when the project is linked. */
+    runUrl?: string;
+    /** How each journey of a platform plan ended, worst lane first. Absent for an unplanned drive. */
+    journeys?: readonly JourneyResult[];
+    /** The platform plan this run drove, which the dashboard keeps, edits and runs again. */
+    planId?: string;
+    /** That plan's page on the dashboard. */
+    planUrl?: string;
+    /** Each goal the session's coding agent also judged, and how the two verdicts compare. */
+    disparity?: readonly RunDisparity[];
 }
-/**
- * Why the harness is unavailable, phrased as the way to make it available.
- *
- * A missing key is a configuration fact, not a fault, and the sentence a user reads has to tell them
- * the one thing to do about it. Named here because both the CLI and the honest no-flows refusal
- * print it, and two copies of this sentence would drift.
- */
-export declare const MSG_NO_HARNESS_KEY: string;
-/**
- * The environment, plus the credential this machine already has.
- *
- * `reticle link` mints a project-scoped key and files it in `~/.reticle/credentials.json`; the CLI
- * has read it from there for as long as it has existed. The harness did not, and read only
- * `process.env` — so somebody who had signed in, linked their project and been told they were
- * connected still got "no model configured to drive the app", and the only way out was to find the
- * key in the console and export it by hand. Five manual steps to reach a feature they had already
- * finished setting up.
- *
- * Resolved into the env rather than threaded through four call sites: the drivers and the
- * preference lookup all read an env record, and giving them a completed one leaves each of them
- * exactly as simple as it was. The key precedence is the resolver's, the same as sync's and the
- * CLI's: the stored key for the link's host, else the exported one (which is how CI, with no
- * keystore, gets here). An explicitly exported HOST still wins, so a proxy is not overridden.
- *
- * The credential arrives through `deps.linkedCloud`, a port, because resolving it here would make
- * the tool surface reach into `memory/cloud` — a reach the directory guard refused, correctly.
- */
-export declare function withLinkedCredential(deps: ToolDeps, env: Record<string, string | undefined>): Promise<Record<string, string | undefined>>;
-/**
- * Can this machine reach the Harness? Only through the platform: a linked project or a platform
- * key. Whether the workspace is entitled is the platform's answer, asked when the drive starts.
- */
-export declare function harnessAvailable(env: Record<string, string | undefined>): boolean;
 /**
  * Read the step ceiling out of the environment.
  *
@@ -135,10 +132,11 @@ export declare function maxStepsFromEnv(env: Record<string, string | undefined>)
  * that says it saved a flow and did not is the same false green as an app that says it saved a
  * record and did not — and this product does not get to make that mistake about its own work.
  */
-export declare function exploreApp(deps: ToolDeps, env: Record<string, string | undefined>, options?: ExploreOptions): Promise<ExploreResult>;
+export declare function exploreApp(deps: ToolDeps, given: Record<string, string | undefined>, asked?: ExploreOptions): Promise<ExploreResult>;
+/** The stop and the words of whoever started the drive, for `runHarness`. */
+export declare function steering(options: ExploreOptions): Pick<HarnessOptions, 'stopped' | 'inbox'>;
 /** A line in the HUD's Agent Log for the person watching; nobody watching is not an error. */
-export declare function narrator(deps: ToolDeps, options: ExploreOptions): (text: string) => void;
-/** What this project's memory says must hold, in its own words. Nothing recorded is none. */
+export declare function narrator(deps: ToolDeps, options: ExploreOptions): (text: string, summary?: boolean) => void;
 export declare function productRules(deps: ToolDeps, sessionId?: string): Promise<string[]>;
 /** `deps` whose flow store is the session's own project, where the drive's saves land. */
 export declare function withProjectFlows(deps: ToolDeps, sessionId?: string): ToolDeps;
@@ -181,39 +179,16 @@ export declare function reconcileFlows(before: ReadonlySet<string>, after: reado
     rewroteFlows: readonly string[];
 };
 /**
- * What a person said about autonomous driving on the platform, honoured here.
- *
- * The switch existed, persisted and round-tripped, and the daemon read it and threw it away — so
- * turning the harness OFF changed a value in a database and nothing else. A control that does not
- * control anything is worse than no control: somebody turns it off, watches Reticle drive their app
- * anyway, and now correctly distrusts every other switch in the product.
- *
- * Absent means ON. The platform's own default is on, and a machine that cannot reach the platform —
- * offline, CI, no link — must not silently lose a feature it was never told to stop using.
- */
-export declare const MSG_HARNESS_DISABLED: string;
-/**
- * The other reason a drive can be refused, and it is NOT the same reason.
- *
- * A drive through the platform spends Reticle's model budget, bounded by the workspace's monthly
- * Harness credits. The platform answers this only when something other than the switch stops it.
- */
-export declare const MSG_HARNESS_UNCLAIMED: string;
-/** The platform could not be asked, and the drive would spend Reticle's budget without its yes. */
-export declare const MSG_HARNESS_UNCONFIRMED: string;
-/**
- * The reason this drive must not start, or `undefined` to go ahead.
- *
- * A drive on somebody's OWN model key never waits on the platform beyond the off switch: their key,
- * their spend. A drive through the platform proxy bills Reticle, and that one needs a confirmed yes
- * — enabled, entitled, and a model ready. It used to fail open: `fetchPlatformConfig` answers
- * `undefined` on a network error, a non-2xx, a body that does not parse, or a two-second timeout,
- * and all four read as "carry on", so a slow second on a settings endpoint let an unentitled
- * workspace drive on Reticle's budget. Now the same silence refuses with a message that says to
- * retry or bring a key. Fields an older platform omits still default to yes inside
- * `fetchPlatformConfig`; only an answer that never arrived is a no.
+ * Why a drive must not be replayed into a verdict, or undefined when it may. A drive the platform
+ * cut off (credits gone: 402 needs_card) had saved one partial flow, and replaying it printed PASS
+ * with no word about the credits. The one test both CLI explore paths answer through.
  */
-export declare function refusedByPlatform(env: Record<string, string | undefined>, options: ExploreOptions): Promise<string | undefined>;
+export declare function cutOffReason(drive: {
+    stopReason?: unknown;
+    error?: unknown;
+}): string | undefined;
+/** The Agent Log's last line for a drive the platform cut off: its reason, and that it proved nothing. */
+export declare const msgDriveCutOff: (error: string | undefined) => string;
 /**
  * Close and save whatever recording the drive left open.
  *
@@ -232,8 +207,10 @@ export declare function refusedByPlatform(env: Record<string, string | undefined
  * It used to be "Autonomous drive of X, banked after the run ended" whatever the caller asked for,
  * so a replay could never say which journey the flow was meant to prove.
  */
-export declare function bankedIntent(persona: string | undefined, open: string): string;
-export declare function bankOpenRecording(toolset: HarnessToolset, drive: HarnessResult, persona: string | undefined): Promise<void>;
+export declare function bankedIntent(persona: string | undefined, open: string, 
+/** The journey the drive was for, when no persona was named. */
+journey?: string): string;
+export declare function bankOpenRecording(toolset: HarnessToolset, drive: HarnessResult, persona: string | undefined, journey?: string): Promise<ToolOutcome[]>;
 /** The recording started and never stopped, if there is one. Exported because it is the decision. */
 export declare function openRecordingName(toolCalls: readonly ToolOutcome[]): string | undefined;
 /**
@@ -254,7 +231,9 @@ export declare function pinned(options: ExploreOptions): {
  */
 export declare function buildDriver(env: Record<string, string | undefined>, maxSteps: number, plan: HarnessPlan, requested?: string, persona?: string, 
 /** A goal driven with no persona: it names the drive's flows as a persona would. */
-journey?: string): {
+journey?: string, 
+/** The survey of the app, which the platform's engine looks goals up in. */
+siteMap?: HarnessMap): {
     driver: ModelDriver;
     name: string;
 };

package/dist/surface/tools/harness-explore.js

@@ -10,78 +10,32 @@
 import { serverDriver, serverOptionsFromEnv } from '../../features/harness/platform/server-driver.js';
 import { exploreScript } from './harness-script.js';
 import { randomUUID } from 'node:crypto';
-import { harnessRunId } from '../../judgement/runs/drive-run.js';
-import { ReticleEnv, ReticleTool, asProjectId, cloudUrlFrom, asRecord, } from '@reticlehq/core';
+import { harnessRunId, noteHarnessDisparity, noteHarnessGoal, noteHarnessSpan, } from '../../judgement/runs/drive-run.js';
+import { ReticleEnv, ReticleTool, asProjectId, asRecord } from '@reticlehq/core';
 import { flowsForSession } from '../../language/flows/flow-store-for-session.js';
 import { projectForRoot } from '../../memory/project/project-for-root.js';
-import { checkTally, verdictLine } from '../../features/harness/drive-report.js';
+import { actedOnApp, checkTally, pagesReached, typedValues, verdictLine, } from '../../features/harness/drive-report.js';
 import { CUSTOM_DRIVER_NAME, SERVER_DRIVER } from '../../features/harness/drivers.js';
 import { buildDomainModel } from '../../judgement/domain/domain-model.js';
 import { readContract } from '../../memory/project/dir/reticle-dir.js';
 import { sessionRoot, sessionTarget } from '../../memory/project/session-root.js';
-import { buildHarnessPlan, planAsText, withoutReplays } from './harness-plan.js';
+import { dashboardPlanUrl, dashboardRunUrl, readDashboardUrl, readLinkedProjectId, } from '../../memory/project/sync-status.js';
+import { buildHarnessPlan, drivingPlan, planAsText } from './harness-plan.js';
 import { allSessionIntents } from '../../memory/intent/open-intents.js';
-import { fetchPlatformConfig } from '../../features/harness/platform-config.js';
 import { DEFAULT_MAX_STEPS, runHarness, StopReason, } from '../../features/harness/harness.js';
 import { reticleToolset } from './harness-toolset.js';
-import { checkGoals, goalsIn } from '../../features/harness/goals.js';
-/**
- * Why the harness is unavailable, phrased as the way to make it available.
- *
- * A missing key is a configuration fact, not a fault, and the sentence a user reads has to tell them
- * the one thing to do about it. Named here because both the CLI and the honest no-flows refusal
- * print it, and two copies of this sentence would drift.
- */
-export const MSG_NO_HARNESS_KEY = `The Reticle Harness runs on the Reticle platform, and every plan includes it (Free comes with ` +
-    `monthly Harness credits): run \`reticle connect\` to link this project and sign in. ` +
-    `Without it, drive the journey yourself with reticle_act_and_wait and an \`until\` on its last step: ` +
-    `what you drive is saved as a flow just the same.`;
+import { DriveRefusedError, noteDriveLine } from '../../features/harness/drive-runs.js';
+import { personaCredentials } from '../../features/harness/platform/persona-credentials.js';
+import { endOf, goalOfDrive, parseGoals, readOpening, unprovedGoals, } from '../../features/harness/goals.js';
+import { mapForPlatform } from '../../features/harness/explore/site-map.js';
+import { huntAndGrade, knownRoutes, refreshMap, siteMapFor } from './harness-hunt.js';
+export { MSG_HARNESS_DISABLED, MSG_HARNESS_UNCLAIMED, MSG_HARNESS_UNCONFIRMED, } from '../../features/harness/platform/refusal.js';
+import { MSG_NO_HARNESS_KEY, refusedForPlan } from './harness-gate.js';
+// The gate a drive passes before it starts moved to its own module; its names are still asked for here.
+export { MSG_GATE_PROMPT_LEAD, MSG_NO_HARNESS_KEY, coverageRefusal, firstLine, harnessAvailable, harnessLockRefusal, refusedByPlatform, withLinkedCredential, } from './harness-gate.js';
 /** A driver named that this build no longer has: every Harness decision is the platform's now. */
 const msgUnknownDriver = (asked) => `The Harness driver \`${asked}\` is not available: the Harness runs on the Reticle platform, ` +
     `which drives with the model set for the project in the dashboard.`;
-/**
- * The environment, plus the credential this machine already has.
- *
- * `reticle link` mints a project-scoped key and files it in `~/.reticle/credentials.json`; the CLI
- * has read it from there for as long as it has existed. The harness did not, and read only
- * `process.env` — so somebody who had signed in, linked their project and been told they were
- * connected still got "no model configured to drive the app", and the only way out was to find the
- * key in the console and export it by hand. Five manual steps to reach a feature they had already
- * finished setting up.
- *
- * Resolved into the env rather than threaded through four call sites: the drivers and the
- * preference lookup all read an env record, and giving them a completed one leaves each of them
- * exactly as simple as it was. The key precedence is the resolver's, the same as sync's and the
- * CLI's: the stored key for the link's host, else the exported one (which is how CI, with no
- * keystore, gets here). An explicitly exported HOST still wins, so a proxy is not overridden.
- *
- * The credential arrives through `deps.linkedCloud`, a port, because resolving it here would make
- * the tool surface reach into `memory/cloud` — a reach the directory guard refused, correctly.
- */
-export async function withLinkedCredential(deps, env) {
-    try {
-        const linked = await deps.linkedCloud?.();
-        if (linked === undefined || null === linked)
-            return env;
-        return {
-            ...env,
-            [ReticleEnv.API_KEY]: linked.apiKey,
-            [ReticleEnv.CLOUD_URL]: cloudUrlFrom(env) ?? linked.url,
-        };
-    }
-    catch {
-        // A credential store that cannot be read is "not linked", not an error. The harness is optional
-        // and its absence is a routine answer; a drive must never fail because a JSON file was odd.
-        return env;
-    }
-}
-/**
- * Can this machine reach the Harness? Only through the platform: a linked project or a platform
- * key. Whether the workspace is entitled is the platform's answer, asked when the drive starts.
- */
-export function harnessAvailable(env) {
-    return serverOptionsFromEnv(env) !== undefined;
-}
 /**
  * Read the step ceiling out of the environment.
  *
@@ -104,10 +58,15 @@ export function maxStepsFromEnv(env) {
  * that says it saved a flow and did not is the same false green as an app that says it saved a
  * record and did not — and this product does not get to make that mistake about its own work.
  */
-export async function exploreApp(deps, env, options = {}) {
-    const refusal = await refusedByPlatform(env, options);
+export async function exploreApp(deps, given, asked = {}) {
+    // Every drive starts here. The credentials a persona names fill its sign-in fields on this
+    // machine, and only the redacted text travels on: to the platform, into flows and synced runs.
+    const named = asked.focus === undefined ? undefined : personaCredentials(asked.focus);
+    const env = named === undefined ? given : { ...given, ...named.secrets };
+    const options = named === undefined ? asked : { ...asked, focus: named.persona };
+    const refusal = await refusedForPlan(env, options);
     if (refusal !== undefined)
-        throw new Error(refusal);
+        throw new DriveRefusedError(refusal);
     // The flows a drive reads and diffs are the PROJECT's, which is where its saves land.
     const reads = withProjectFlows(deps, options.sessionId);
     // No journey named: plan the drive first. The platform's Harness proposes the people worth being;
@@ -116,36 +75,56 @@ export async function exploreApp(deps, env, options = {}) {
     const before = new Set(await reads.flows.list());
     // Without a named journey the drive is always planned; with one, it is planned by the platform
     // when there is one, and driven here as before when there is not.
-    if (options.focus === undefined || serverOptionsFromEnv(env) !== undefined) {
+    if (options.focus === undefined ||
+        options.planId !== undefined ||
+        serverOptionsFromEnv(env) !== undefined) {
         const scripted = await exploreScript(deps, env, options, before);
+        // Where the person opens it: the run, and the plan the dashboard keeps and runs again.
         if (scripted !== undefined)
-            return scripted;
+            return {
+                ...scripted,
+                ...runUrlFor(deps, options.sessionId, scripted.runIds?.[0]),
+                ...planUrlFor(deps, options.sessionId, scripted.planId),
+            };
     }
     const maxSteps = options.maxSteps ?? maxStepsFromEnv(env);
     // `.reticle` FIRST, before the app and before anything reads a line of source. It already holds
     // every saved flow, the consequence that must hold for each, and the declared intent nobody has
     // tested — which is the whole of what a drive should be deciding against.
     const plan = await readPlan(reads, options.sessionId);
-    const driving = withoutReplays(plan);
-    const built = options.driver === undefined
-        ? buildDriver(env, maxSteps, driving, options.driverName, options.focus)
-        : { driver: options.driver, name: CUSTOM_DRIVER_NAME };
-    const driver = built.driver;
+    const driving = drivingPlan(plan, options.focus);
+    // Refused before anything touches the app: an unknown driver, or no platform to drive with.
+    if (options.driver === undefined)
+        buildDriver(env, maxSteps, driving, options.driverName, options.focus);
     // Every action this drive takes carries who took it, so the run it folds into is the Harness's own
     // and not mixed into the run of whichever agent shares the tab.
-    const harnessId = randomUUID();
+    const harnessId = options.harnessId ?? randomUUID();
+    const driverLabel = options.driver === undefined ? SERVER_DRIVER : CUSTOM_DRIVER_NAME;
     const toolset = reticleToolset(deps, {
         ...pinned(options),
         drivenBy: {
             harness: harnessId,
-            driver: built.name,
+            driver: driverLabel,
             ...(options.focus === undefined ? {} : { persona: options.focus }),
         },
+        ...(options.focus === undefined ? {} : { asked: options.focus }),
     });
     const narrate = narrator(deps, options);
-    narrate(`Harness is driving${options.focus === undefined ? '' : `: ${options.focus}`}`);
+    const invoke = (name, args) => toolset.invoke(name, args);
+    // Map first: survey the app (no model) unless this app's map is fresh, and leave the tab at start.
+    const map = await siteMapFor(deps, options.sessionId, invoke);
+    const built = options.driver === undefined
+        ? buildDriver(env, maxSteps, driving, options.driverName, options.focus, undefined, map)
+        : { driver: options.driver, name: CUSTOM_DRIVER_NAME };
+    const driver = built.driver;
+    // Read before anything is driven: a goal this page already shows proves nothing at the end.
+    const opening = await readOpening(invoke);
+    narrate(`Harness is driving${options.focus === undefined ? '' : `: ${options.focus}`}`, true);
+    const driveStarted = deps.now();
     const drive = await runHarness(driver, toolset, {
+        ...steering(options),
         maxSteps,
+        routes: knownRoutes(map),
         // The plan rides in as standing instruction, so it is in front of the model on every turn
         // rather than remembered from a first one. `focus` is the caller's own words and goes last:
         // somebody who named a journey meant that journey, whatever the project's backlog says.
@@ -153,18 +132,48 @@ export async function exploreApp(deps, env, options = {}) {
             planAsText(driving),
             ...(options.focus === undefined ? [] : [`Focus: ${options.focus}`]),
         ].join('\n\n'),
+        // The end the caller's words quote stops the drive once it shows: see HarnessOptions.endsAt.
+        ...((end) => end === undefined || options.focus === undefined
+            ? {}
+            : { endsAt: { text: end, own: [options.focus] } })(endOf(options.focus ?? '')),
     });
+    // Before the session ends and is graded: a drive whose goal was missed, or that was cut off part-way,
+    // must not sync as "Proved" on the checks that held before it stopped.
+    noteHarnessGoal(harnessId, drive.goalMet);
     narrate(StopReason.STOPPED === drive.stopReason
         ? `Autonomous driving switched off — the Harness stopped after ${String(drive.steps)} steps. What it drove is kept.`
-        : `Harness finished — ${verdictLine(checkTally(drive.toolCalls))}`);
+        : StopReason.BROKEN === drive.stopReason
+            ? msgDriveCutOff(drive.error)
+            : `Harness finished — ${verdictLine(checkTally(drive.toolCalls))}`, true);
     // MANDATORY, and deliberately outside the loop. A drive that runs out of budget mid-journey, or
     // breaks, or whose model simply stops asking for tools, leaves a recording open and everything it
     // drove unsaved — work paid for and thrown away. Saving is not a decision any model gets to make
     // and not something a step budget gets to cut off, so it happens here, after the loop, always.
-    await bankOpenRecording(toolset, drive, options.focus);
-    const goals = await checkGoals((name, args) => toolset.invoke(name, args), options.goals ?? goalsIn(options.focus));
+    const banked = await bankOpenRecording(toolset, drive, options.focus);
+    await refreshMap(deps, options.sessionId, map, drive.toolCalls);
+    // Hunt for the journey's end before grading: never a `no` from where the drive happened to stop.
+    const graded = await huntAndGrade(deps, invoke, {
+        sessionId: options.sessionId,
+        goals: options.goals ?? parseGoals(options.focus),
+        expect: options.expect,
+        opening,
+        journey: options.focus,
+        map,
+        reached: pagesReached(drive.toolCalls),
+        typed: typedValues(drive.toolCalls),
+    });
+    const goals = graded.goals;
+    noteHarnessDisparity(harnessId, graded.disparity);
+    // The goals it was given decide whether the journey was done, not a click that held on the way,
+    // and never the driver's word over a drive that did nothing.
+    const goalMet = goalOfDrive(drive.goalMet, goals, actedOnApp(drive.toolCalls));
+    noteHarnessGoal(harnessId, goalMet);
+    noteHarnessSpan(harnessId, deps.now() - driveStarted);
+    const unproved = unprovedGoals(goals);
+    if (unproved !== undefined)
+        narrate(unproved, true);
     const after = await reads.flows.list();
-    const reconciled = reconcileFlows(before, after, drive.toolCalls);
+    const reconciled = reconcileFlows(before, after, [...drive.toolCalls, ...banked]);
     if (options.focus !== undefined) {
         await recordPersona(reads, [...reconciled.savedFlows, ...reconciled.rewroteFlows], options.focus);
     }
@@ -174,27 +183,80 @@ export async function exploreApp(deps, env, options = {}) {
     ]);
     const runId = harnessRunId(harnessId);
     return {
-        drive,
+        // The hunt's navigations after the drive's own calls: they are the Harness driving the app too.
+        // After the goal is decided, which counts only what the drive itself did.
+        drive: {
+            ...drive,
+            toolCalls: [...drive.toolCalls, ...graded.moved],
+            ...(goalMet === undefined ? {} : { goalMet }),
+        },
         plan,
         driverName: built.name,
         ...reconciled,
         unverifiedFlows,
         goals,
+        ...(0 === graded.disparity.length ? {} : { disparity: graded.disparity }),
         ...(runId === undefined ? {} : { runIds: [runId] }),
+        ...runUrlFor(deps, options.sessionId, runId),
+    };
+}
+/** The stop and the words of whoever started the drive, for `runHarness`. */
+export function steering(options) {
+    return {
+        ...(options.stopped === undefined ? {} : { stopped: options.stopped }),
+        ...(options.inbox === undefined ? {} : { inbox: options.inbox }),
     };
 }
 /** A line in the HUD's Agent Log for the person watching; nobody watching is not an error. */
 export function narrator(deps, options) {
-    return (text) => {
+    return (text, summary = false) => {
+        // The drive's poll answers with its latest line, whether or not a tab is watching.
+        if (options.harnessId !== undefined)
+            noteDriveLine(options.harnessId, text);
         try {
-            deps.sessions.resolve(options.sessionId).pushNarration(text);
+            // Filed in the HUD's Harness log; its start and end lines in the Agent Log too.
+            deps.sessions
+                .resolve(options.sessionId)
+                .pushNarration(text, true, { harness: true, summary });
         }
         catch {
             /* nobody is watching: the drive still runs */
         }
     };
 }
-/** What this project's memory says must hold, in its own words. Nothing recorded is none. */
+/** The plan's page on the dashboard, where it is edited and run again; nothing when unlinked. */
+function planUrlFor(deps, sessionId, planId) {
+    if (planId === undefined)
+        return {};
+    try {
+        const root = sessionRoot(deps, sessionId);
+        const dashboard = readDashboardUrl(root);
+        return dashboard === undefined
+            ? {}
+            : {
+                planUrl: dashboardPlanUrl({
+                    dashboardUrl: dashboard,
+                    planId,
+                    projectId: readLinkedProjectId(root),
+                }),
+            };
+    }
+    catch {
+        return {};
+    }
+}
+/** The run's page on the dashboard, when the tab's project is linked; nothing when it is not. */
+function runUrlFor(deps, sessionId, runId) {
+    if (runId === undefined)
+        return {};
+    try {
+        const dashboard = readDashboardUrl(sessionRoot(deps, sessionId));
+        return dashboard === undefined ? {} : { runUrl: dashboardRunUrl(dashboard, runId) };
+    }
+    catch {
+        return {}; // no tab, no project: the run is still reported, without a link
+    }
+}
 export async function productRules(deps, sessionId) {
     try {
         return (await allSessionIntents(deps, sessionId)).map((intent) => intent.statement);
@@ -293,69 +355,30 @@ export function reconcileFlows(before, after, toolCalls) {
         return 'string' === typeof flowName ? flowName : undefined;
     })
         .filter((name) => name !== undefined && present.has(name));
+    // Only what this drive's own saves wrote: a before/after diff of the project's flows claimed the
+    // flows other agents saved in the same project at the same time.
     return {
-        savedFlows: after.filter((name) => !before.has(name)),
+        savedFlows: [...new Set(claimed.filter((name) => !before.has(name)))],
         rewroteFlows: [...new Set(claimed.filter((name) => before.has(name)))],
     };
 }
 /**
- * What a person said about autonomous driving on the platform, honoured here.
- *
- * The switch existed, persisted and round-tripped, and the daemon read it and threw it away — so
- * turning the harness OFF changed a value in a database and nothing else. A control that does not
- * control anything is worse than no control: somebody turns it off, watches Reticle drive their app
- * anyway, and now correctly distrusts every other switch in the product.
- *
- * Absent means ON. The platform's own default is on, and a machine that cannot reach the platform —
- * offline, CI, no link — must not silently lose a feature it was never told to stop using.
- */
-export const MSG_HARNESS_DISABLED = 'Autonomous driving is turned OFF for this project. Turn it back on in the Reticle dashboard ' +
-    '(Settings → Verification model), or drive the app yourself through the MCP tools.';
-/**
- * The other reason a drive can be refused, and it is NOT the same reason.
- *
- * A drive through the platform spends Reticle's model budget, bounded by the workspace's monthly
- * Harness credits. The platform answers this only when something other than the switch stops it.
+ * Why a drive must not be replayed into a verdict, or undefined when it may. A drive the platform
+ * cut off (credits gone: 402 needs_card) had saved one partial flow, and replaying it printed PASS
+ * with no word about the credits. The one test both CLI explore paths answer through.
  */
-export const MSG_HARNESS_UNCLAIMED = 'The Reticle platform says this workspace cannot drive the Harness right now. Every workspace, ' +
-    'Free included, gets Harness credits each month: see Settings → Plan in the Reticle dashboard.';
-/** The platform could not be asked, and the drive would spend Reticle's budget without its yes. */
-export const MSG_HARNESS_UNCONFIRMED = 'Could not confirm Harness access with the Reticle platform, so the drive did not start. Try ' +
-    'again in a moment.';
-/** One read, however many questions are asked of the answer. */
-function platformConfig(env, options) {
-    return options.configFetch === undefined
-        ? fetchPlatformConfig(env)
-        : fetchPlatformConfig(env, options.configFetch);
-}
-/**
- * The reason this drive must not start, or `undefined` to go ahead.
- *
- * A drive on somebody's OWN model key never waits on the platform beyond the off switch: their key,
- * their spend. A drive through the platform proxy bills Reticle, and that one needs a confirmed yes
- * — enabled, entitled, and a model ready. It used to fail open: `fetchPlatformConfig` answers
- * `undefined` on a network error, a non-2xx, a body that does not parse, or a two-second timeout,
- * and all four read as "carry on", so a slow second on a settings endpoint let an unentitled
- * workspace drive on Reticle's budget. Now the same silence refuses with a message that says to
- * retry or bring a key. Fields an older platform omits still default to yes inside
- * `fetchPlatformConfig`; only an answer that never arrived is a no.
- */
-export async function refusedByPlatform(env, options) {
-    if (true === options.skipPlatformConfig)
+export function cutOffReason(drive) {
+    if (StopReason.BROKEN !== drive.stopReason && StopReason.STOPPED !== drive.stopReason)
         return undefined;
-    // No platform, no Harness: it runs there, on the workspace's credits.
-    if (serverOptionsFromEnv(env) === undefined)
-        return MSG_NO_HARNESS_KEY;
-    const config = await platformConfig(env, options);
-    // It needs a confirmed yes, not the absence of a no. The platform also checks on every turn.
-    if (config === undefined)
-        return MSG_HARNESS_UNCONFIRMED;
-    if (!config.harnessEnabled)
-        return MSG_HARNESS_DISABLED;
-    if (!config.harnessEntitled)
-        return MSG_HARNESS_UNCLAIMED;
-    return undefined;
+    const why = 'string' === typeof drive.error && 0 < drive.error.length
+        ? drive.error
+        : StopReason.STOPPED === drive.stopReason
+            ? 'autonomous driving was switched off.'
+            : 'the drive broke.';
+    return `The drive stopped before it finished: ${why} Nothing was proved; what it saved stays, and the next run replays it.`;
 }
+/** The Agent Log's last line for a drive the platform cut off: its reason, and that it proved nothing. */
+export const msgDriveCutOff = (error) => `Harness stopped before it finished, so nothing is proved: ${error ?? 'the drive broke.'}`;
 /**
  * Close and save whatever recording the drive left open.
  *
@@ -374,25 +397,28 @@ export async function refusedByPlatform(env, options) {
  * It used to be "Autonomous drive of X, banked after the run ended" whatever the caller asked for,
  * so a replay could never say which journey the flow was meant to prove.
  */
-export function bankedIntent(persona, open) {
-    const named = persona?.trim();
+export function bankedIntent(persona, open, 
+/** The journey the drive was for, when no persona was named. */
+journey) {
+    const named = (persona ?? journey)?.trim();
     return named !== undefined && 0 < named.length
         ? named
-        : `Autonomous drive of ${open}, banked after the run ended.`;
+        : `Exploring the app, recorded as ${open} and saved after the run ended.`;
 }
-export async function bankOpenRecording(toolset, drive, persona) {
+export async function bankOpenRecording(toolset, drive, persona, journey) {
     const open = openRecordingName(drive.toolCalls);
     if (open === undefined)
-        return;
+        return [];
+    const args = { flowName: open, intent: bankedIntent(persona, open, journey) };
     try {
         await toolset.invoke(ReticleTool.RECORD, { action: 'stop', recordingName: open });
-        await toolset.invoke(ReticleTool.FLOW_SAVE, {
-            flowName: open,
-            intent: bankedIntent(persona, open),
-        });
+        const result = await toolset.invoke(ReticleTool.FLOW_SAVE, args);
+        // Returned so the save is this drive's own, as a save the model made is.
+        return [{ id: 'bank', name: ReticleTool.FLOW_SAVE, args, result, isError: false }];
     }
     catch {
         /* last chance, not a checkpoint */
+        return [];
     }
 }
 /** The recording started and never stopped, if there is one. Exported because it is the decision. */
@@ -458,7 +484,9 @@ export function pinned(options) {
  */
 export function buildDriver(env, maxSteps, plan, requested, persona, 
 /** A goal driven with no persona: it names the drive's flows as a persona would. */
-journey) {
+journey, 
+/** The survey of the app, which the platform's engine looks goals up in. */
+siteMap) {
     if (requested !== undefined && SERVER_DRIVER !== requested)
         throw new Error(msgUnknownDriver(requested));
     const platform = serverOptionsFromEnv(env);
@@ -473,6 +501,9 @@ journey) {
             planSteps: plan.steps,
             vocabulary: plan.vocabulary,
             maxSteps,
+            ...(siteMap === undefined ? {} : { siteMap: mapForPlatform(siteMap) }),
+            // Secret fields fill from the drive's own env: a persona's credentials ride in it.
+            env,
         }),
         name: SERVER_DRIVER,
     };