@signalridge/pi-workflows 1.4.0 → 1.6.0

package/skills/workflow-authoring/references/capability-details.md

@@ -1,8 +1,8 @@
 <!-- GENERATED from WORKFLOW_CAPABILITY_CONTRACT; do not edit by hand. -->
 # Exhaustive workflow capability facts
 
-Contract format: `1.0.0`<br>
-Contract content / skill / extension: `1.4.0`
+Contract format: `2.0.0`<br>
+Contract content / skill / extension: `1.6.0`
 
 Every exact fact below is projected from the installed extension's capability contract. Explanatory judgment belongs in the hand-written references next to this file.
 
@@ -16,8 +16,7 @@ Every exact fact below is projected from the installed extension's capability co
 - `label`: string (optional); default: derived from phase and call count
 - `phase`: string (optional); default: current phase
 - `schema`: plain JSON Schema (optional)
-- `model`: string (optional); default: pi-subagents model resolver
-- `tier`: small\|medium\|large (optional); default: pi-subagents workflow tier
+- `strength`: "low" \| "medium" \| "high" (optional); default: no tier is sent; the agent's own tier, else agentTiers.defaultTier
 - `isolation`: "worktree" (optional); default: pi-subagents worktree policy
 - `thread`: string (optional); default: fresh session per call
 - `toolset`: string (optional); default: configured host/agent toolset hint
@@ -30,9 +29,15 @@ Every exact fact below is projected from the installed extension's capability co
 - Constraint: resume replays only the longest unchanged prefix; the first miss and every later call execute live
 - Constraint: replayed calls do not consume the real-dispatch maxAgents or token/phase budgets
 - Constraint: spawnKeys rotate by generation on resume so pi-subagents never raises a fingerprint conflict
-- Constraint: explicit model is resolved and scope-checked by pi-subagents; unavailable selectors fail closed
+- Constraint: strength is this package's own vocabulary, not an agentTiers key; a word outside low/medium/high is rejected before dispatch
+- Constraint: a strengths table alone binds a strength to an agent tier; an unmapped strength dispatches with no tier and takes the agent's own default
+- Constraint: a call that names no strength also dispatches with no tier; there is no default strength, so an unlabelled call never outranks the agent type's own tier
+- Constraint: an unconfigured host uses a shipped default table: each strength on the catalogue tier of the same name, where the host defines one
+- Constraint: resolveAgentTier in pi-subagents owns model, thinking, clamping, availability, and the resolution snapshot
+- Constraint: there is no per-call model, thinking, or tier: a strength is the only model policy a workflow can express
 - Constraint: same-thread calls must be sequential and preserve a stable workflow thread name
 - Constraint: threads cannot be combined with worktree isolation
+- Constraint: an option name outside this list is rejected before dispatch, not ignored; tier, model, and thinking name their replacement
 
 <a id="runtime-global-parallel"></a>
 ## parallel
@@ -90,6 +95,7 @@ Every exact fact below is projected from the installed extension's capability co
 - `reviewers`: number (optional); default: 2
 - `threshold`: number (optional); default: 0.5
 - `lens`: string \| string[] (optional)
+- `strength`: "low" \| "medium" \| "high" (optional); default: "low"
 - Constraint: threshold comparison is inclusive; real is false when no reviewer succeeds
 
 <a id="runtime-global-judgepanel"></a>
@@ -100,6 +106,7 @@ Every exact fact below is projected from the installed extension's capability co
 - Signature: `judgePanel(attempts, options?) => Promise<{ index, attempt, score, judgments } \| undefined>`
 - `judges`: number (optional); default: 3
 - `rubric`: string (optional); default: overall quality and correctness
+- `strength`: "low" \| "medium" \| "high" (optional); default: "low"
 - Constraint: highest mean score wins with stable input index as the tie-break; empty input returns undefined
 
 <a id="runtime-global-loopuntildry"></a>
@@ -119,7 +126,8 @@ Every exact fact below is projected from the installed extension's capability co
 
 - Classification: `runtime-global`
 - Support: `supported`
-- Signature: `completenessCheck(taskArgs, results) => Promise<{ complete, missing? } \| null>`
+- Signature: `completenessCheck(taskArgs, results, options?) => Promise<{ complete, missing? } \| null>`
+- `strength`: "low" \| "medium" \| "high" (optional); default: "medium"
 - Constraint: only the first 4,000 characters of serialized result evidence are sent to the critic
 
 <a id="runtime-global-retry"></a>
@@ -154,6 +162,7 @@ Every exact fact below is projected from the installed extension's capability co
 - `timeoutMs`: number (optional)
 - Constraint: consumes one agent slot and no tokens
 - Constraint: journaled answers replay only within an unchanged resume prefix
+- Constraint: an option name outside this list is rejected rather than ignored, since a dropped headless silently auto-approves
 
 <a id="runtime-global-log"></a>
 ## log
@@ -299,6 +308,7 @@ Every exact fact below is projected from the installed extension's capability co
 - Signature: `export const meta = { name, description, phases? }`
 - Constraint: must be the first statement
 - Constraint: name and description must be nonblank literals
+- Constraint: workflow meta and phase metadata cannot contain model or thinking fields
 - Constraint: spread, computed keys, methods, template interpolation, and __proto__/constructor/prototype are rejected
 
 <a id="script-contract-determinism"></a>

package/skills/workflow-authoring/references/debugging.md

@@ -8,7 +8,7 @@ Start from the symptom, then reproduce through the real workflow runtime with de
 | `parallel()` rejects input | Promises were passed instead of thunks | [runtime](runtime.md#topology) |
 | Synthesis starts early | Fan-out was not awaited as one complete result set | [pattern selection](pattern-selection.md#fan-out-and-synthesize) |
 | Coverage silently disappears | `null` results were filtered before IDs were ledgered | [lifecycle](lifecycle.md#retry-and-recoverable-failure) |
-| Wrong model is used | A higher-priority selector overrides the expected route | [registry ownership](registry-ownership.md#priority) |
+| Wrong model or thinking is used | The call's strength is unmapped and fell to the agent's default, or the active `strengths` table — the user's, or the shipped default — points it at a profile that is not what you expected | [registry ownership](registry-ownership.md#priority) |
 | Unknown `agentType` log | A live registry name was guessed or is unavailable | [registry ownership](registry-ownership.md#agent-types) |
 | Budget exceeds the number shown | The budget is a soft pre-call gate and work was in flight | [lifecycle](lifecycle.md#bounds-and-budget) |
 | Later calls rerun on resume | An earlier call missed or changed, ending the replayable prefix | [lifecycle](lifecycle.md#resume) |
@@ -23,7 +23,7 @@ Start from the symptom, then reproduce through the real workflow runtime with de
 
 1. Reduce to the smallest script that preserves metadata, labels, work IDs, and the failing topology.
 2. Replace provider calls with deterministic, schema-aware fake agents.
-3. Record call order, labels, phases, prompts, results, and `null` entries.
+3. Record call order, labels, phases, prompts, resolved tiers, results, and `null` entries.
 4. When the failure turns on a disputed signature or default, compare it with the compact [capability index](capabilities.md); follow its exhaustive-facts pointer only when needed.
 5. Separate runtime defects from unsupported authoring assumptions and compatibility-only behavior.
 6. Fix only the demonstrated authoring issue; do not rely on known out-of-scope gaps in nested persistence, resume accounting, checkpoint forms/timeouts, metadata validation, or budget overshoot.

package/skills/workflow-authoring/references/quality-helpers.md

@@ -4,5 +4,5 @@ Keep work IDs outside helper results that may omit failed agents.
 
 | Call | Contract |
 | --- | --- |
-| `verify(item, { reviewers: number, threshold: number, lens: string | string[] })` | Defaults: 2 reviewers, inclusive `0.5`, one lens or a cycled array. Returns `{ real, realCount, total, votes }`. Failed reviewers are omitted; successful votes are the denominator; zero survivors means `real: false`. |
-| `judgePanel(attempts, { judges: number, rubric: string })` | Defaults: 3 judges and `"overall quality and correctness"`. Failed judgments are omitted. Returns the highest mean `{ index, attempt, score, judgments }`; input order wins ties; empty input returns `undefined`. |
+| `verify(item, { reviewers: number, threshold: number, lens: string | string[], strength })` | Defaults: 2 reviewers, inclusive `0.5`, one lens or a cycled array, and `strength: "low"` — reviewers are numerous and narrow, and the vote carries the gate rather than any one reviewer's depth. Returns `{ real, realCount, total, votes }`. Failed reviewers are omitted; successful votes are the denominator; zero survivors means `real: false`. |
+| `judgePanel(attempts, { judges: number, rubric: string, strength })` | Defaults: 3 judges, `"overall quality and correctness"`, and `strength: "low"`. Failed judgments are omitted. Returns the highest mean `{ index, attempt, score, judgments }`; input order wins ties; empty input returns `undefined`. |

package/skills/workflow-authoring/references/registry-ownership.md

@@ -4,14 +4,16 @@ Model routes and agent types are dynamic references. Their shape and owner are d
 
 ## Model routes
 
-The `pi-subagents` workflow-tier settings own route names. Standard routes are `small`, `medium`, and `large`; use another route only when its name and purpose are supplied in context. A route is selected with `tier`. An exact user-requested model is selected with `model` and is resolved/scope-checked by pi-subagents.
+pi-subagents owns the agent-tier catalogue. A workflow never names a key from it: a script names a *strength* (`low`/`medium`/`high`), and the user's `strengths` table is the only thing that binds one to a tier. Tier names depend on active configuration and are intentionally absent from static skill files; you do not need them, because you never write one.
+
+A strength is a statement about the work, not a claim about the host. Every script — shipped or yours — names the same three, and there is no shipped/user distinction, because a strength can never reach the catalogue by itself: the binding is always an entry in a `strengths` table. A host that configured none uses the shipped default table, which is identity wherever the host defines a tier of the same name, so a stock machine honours your `low`/`medium` distinctions without configuration and a host with differently-named tiers leaves every strength unmapped. A user table replaces that default outright, and a strength it omits is unmapped even where a same-named tier exists — which is what lets workflow work be re-priced without touching the tier every ordinary spawn also names.
 
 ## Agent types
 
-The agent registry owns agent-type names and their bound instructions, tools, model, and isolation policy. Use `agentType` only when context supplies both its name and purpose. Do not infer an agent type from a role-like label.
+The agent registry owns agent-type names and their bound instructions, tools, Agent-tier defaults, and isolation policy. Use `agentType` only when context supplies both its name and purpose. Do not infer an agent type from a role-like label.
 
 ## Priority
 
-An explicit per-call `model` wins. A named `agentType` model overrides a tier; an explicit `tier` suppresses the phase/run model so pi-subagents can apply the agent definition and then the selected workflow tier. Without a per-call model or tier, the phase/run model is used when present, followed by pi-subagents defaults and the parent session. Model and thinking fields are resolved independently. Avoid specifying competing selectors unless the override is deliberate.
+A call's strength resolves through the user's `strengths` table into at most one tier key. That key, when there is one, takes precedence over an agent type's own tier default, which takes precedence over `agentTiers.defaultTier`. A call that names no strength, or one whose strength the table does not define, sends no key and leaves that precedence to the host — which is why there is no default strength: one would overrule every agent type's own tier on calls the script never meant to route. `resolveAgentTier()` in pi-subagents then resolves model, thinking, clamping, availability, and the immutable snapshot as one decision. Neither a call, nor workflow meta, nor a phase may carry model, thinking, or tier fields.
 
-Unavailability is fail-closed for explicit `model` and named tiers: pi-subagents reports the selector and does not silently run a different model. An omitted selector may inherit the parent session according to the companion's current settings.
+Unavailability is fail-closed: pi-subagents names the tier and does not silently run a different model. A managed call with no tier and no applicable default is rejected rather than inheriting the parent session — which an unmapped strength can reach on a host whose default has been cleared.

package/skills/workflow-authoring/references/review.md

@@ -6,6 +6,7 @@ Review author-visible behavior, not formatting preferences. When behavior depend
 
 - Is literal `export const meta` the first statement, with a short unique name and useful description?
 - Are only used phases declared, and does each named phase begin at the intended boundary?
+- Are workflow meta and phase objects free of retired `model`/`thinking` fields?
 - Does the script call at least one agent and explicitly return JSON-serializable data?
 - Are imports and nondeterministic APIs absent?
 
@@ -21,8 +22,10 @@ Review author-visible behavior, not formatting preferences. When behavior depend
 
 - Does JavaScript consume structured fields only after a small plain JSON Schema guarantees them?
 - Does synthesis receive complete coverage and failure ledgers?
-- Are `model`, `tier`, and `agentType` used according to selector priority?
-- Did every nonstandard route or agent type come from context with a name and purpose?
+- Does every call name a `strength` from `low`/`medium`/`high`, chosen for the effort the step deserves rather than copied from a tier name?
+- Does every helper that dispatches for you (`verify`, `judgePanel`, `completenessCheck`) either take its documented default deliberately or pass an explicit `strength`?
+- Is the strength the only model/thinking policy source, resolved through the active `strengths` table and then pi-subagents' `resolveAgentTier()`?
+- Did every agent-type name come from context with a name and purpose?
 
 ## Lifecycle
 
@@ -33,6 +36,7 @@ Review author-visible behavior, not formatting preferences. When behavior depend
 - Does nesting stay one level, allow only safe sibling concurrency, and account for shared limits/store?
 - Are helper attempts and graph retries finite and separately visible?
 - Would lexical call order and generated graph order remain stable under resume?
+- Does the journal/tombstone retain the resolved `tier`, including one the host defaulted to?
 
 ## Compatibility and publication
 

package/skills/workflow-authoring/references/runtime.md

@@ -4,7 +4,7 @@ Use this page for routine scripts. Open the generated capability index only when
 
 ## Script envelope
 
-Start with the only legal export: `export const meta = { name, description, phases?: [{ title, detail?, model? }] }`. Values are nonblank literals; declare only used phases and call `phase()` before each phase's work. The remaining body already runs inside an async function: write helpers as ordinary declarations; `export default` and other exports are invalid. Return the result explicitly.
+Start with the only legal export: `export const meta = { name, description, phases?: [{ title, detail? }] }`. Values are nonblank literals; declare only used phases and call `phase()` before each phase's work. Workflow meta and phase objects must not contain `model` or `thinking`; those retired fields are rejected. The remaining body already runs inside an async function: write helpers as ordinary declarations; `export default` and other exports are invalid. Return the result explicitly.
 
 The runtime supplies `agent`, `parallel`, `pipeline`, `orchestrate`, `workflow`, quality/control helpers, `phase`, `log`, `args`, `cwd`, restricted `process.cwd()`, and `budget`. Imports, `require()`, filesystem modules, `Date.now()`, `Math.random()`, and no-argument `new Date()` are unavailable. The Node VM realm is implementation substrate, not a security boundary or public API.
 
@@ -17,7 +17,7 @@ The runtime supplies `agent`, `parallel`, `pipeline`, `orchestrate`, `workflow`,
 
 ## Data and failure
 
-Call `agent(prompt, { label, schema? })`; it returns text, a schema-validated value, or recoverable `null`. Nonrecoverable limit, validation, and budget failures throw. Record each intended work ID before filtering. A `null` means missing coverage, never a negative finding.
+Call `agent(prompt, { label, schema?, strength? })`; it returns text, a schema-validated value, or recoverable `null`. `strength` is `low`/`medium`/`high` and has no default — omitting it sends no tier. Nonrecoverable limit, validation, budget, unknown-strength, and unavailable-tier failures throw. Record each intended work ID before filtering. A `null` means missing coverage, never a negative finding.
 
 Use `agent(prompt, { thread: "implementer" })` when the same managed subagent must receive a later follow-up with its complete conversation intact. Reuse a thread name sequentially; never put same-thread calls in one `parallel()` batch. Threads are scoped to one workflow run/session and cannot use worktree isolation. A pause or process restart may require a fresh thread session.
 
@@ -25,6 +25,6 @@ When JavaScript reads fields, pass a small plain JSON Schema. Schema noncomplian
 
 ## Routing and support
 
-An explicit per-call `model` wins. A named `agentType` model overrides `tier`; specifying `tier` suppresses the phase/run model and delegates model/thinking resolution to pi-subagents. Without a per-call selector, the phase/run model is used when present, followed by pi-subagents defaults and the parent session. Explicit unavailable models and tiers fail closed. Worktree isolation is also fail-closed and remains owned by pi-subagents. See [registry ownership](registry-ownership.md).
+`strength` is this package's own vocabulary — `low`, `medium`, `high` — not a model ID and not an agent-tier key. A `strengths` table is the only thing that binds a strength to a tier: the user's, or a shipped default (identity, wherever the host defines a tier of the same name) on a host that configured none. A strength no table defines dispatches with no tier and takes the agent's own default, then `agentTiers.defaultTier`; a call that names no strength takes that same untiered path, because a default strength would have outranked the agent type's own tier on every unlabelled call. A word outside the three is rejected before dispatch, and so is any option name `agent()` does not read — `tier`, `model`, and `thinking` answer by naming their replacement, anything else lists the legal keys. `checkpoint()` gates its own options the same way. pi-subagents' `resolveAgentTier()` alone resolves the final model, thinking, clamping, availability, and snapshot. A host whose default has been cleared rejects an untiered call instead of inheriting the parent model. There is no per-call model, thinking, or tier, and workflow meta and phases may not carry them either. Worktree isolation remains owned by pi-subagents. See [registry ownership](registry-ownership.md).
 
 Generated entries marked `supported` are authoring API. `console` and whole-script Markdown fences are compatibility-only. VM realm facilities are internal. Active model routes and agent types are dynamic. Use `log()` in new scripts.

package/skills/workflow-authoring/references/specialized-helpers.md

@@ -6,7 +6,7 @@ Preserve candidate or work identity outside helper results that may omit failed
 
 | Helper | Authoring contract |
 | --- | --- |
-| `completenessCheck(args, results)` | Returns `{ complete, missing? }` or recoverable `null`. The critic sees only the first 4,000 serialized characters, so chunk or summarize larger evidence. Treat the verdict as advisory. |
+| `completenessCheck(args, results, { strength })` | Returns `{ complete, missing? }` or recoverable `null`. Defaults to `strength: "medium"`, not `low` like the other gates: one call, no vote to average over, and an open-ended read of the whole task. The critic sees only the first 4,000 serialized characters, so chunk or summarize larger evidence. Treat the verdict as advisory. |
 | `loopUntilDry({ round, key, consecutiveEmpty, maxRounds })` | `round(index)` is zero-based. Defaults: `JSON.stringify` key, two dry rounds, 50 rounds. Null, non-array, and duplicate-only rounds are dry. Token-budget or agent-limit exhaustion returns the partial array without a termination reason; keep failed-round identity and stopping state outside the helper. |
 
 ## Control

package/skills/workflow-authoring/references/versions.md

@@ -9,5 +9,5 @@ When copying a workflow between installations:
 1. Check the destination's generated version and exact capability facts.
 2. Re-check every supported global, option, and constraint used by the script.
 3. Treat compatibility entries as preservation aids, not portable recommendations.
-4. Re-resolve dynamic model routes and agent types from destination context; static docs intentionally contain no live entries.
+4. Re-resolve agent types from destination context; they come from the destination host's configuration, and static docs intentionally contain no live registry entries. Strengths need no re-resolution — the vocabulary is fixed and the mapping belongs to the destination, whether that is the user's table or the shipped default.
 5. Prefer runtime behavior when prose and execution disagree, and report the documentation mismatch rather than changing behavior during an authoring fix.

package/skills/workflow-patterns/SKILL.md

@@ -2,7 +2,7 @@
 name: workflow-patterns
 description: Choose and run one of Pi's built-in multi-agent workflows for research, adversarial review, code review, multi-perspective analysis, or codebase auditing. Use when the request matches a named pattern; use workflow-authoring instead for a new script or custom topology.
 metadata:
-  version: "1.4.0"
+  version: "1.6.0"
 ---
 
 # Built-in workflow patterns

package/skills/workflow-review/SKILL.md

@@ -2,7 +2,7 @@
 name: workflow-review
 description: Audit an existing Pi JavaScript workflow for topology, prompt/data flow, limits, failure handling, cancellation, resume safety, and publication compatibility. Use when reviewing or debugging a workflow script or saved run; do not use to run a standard named workflow.
 metadata:
-  version: "1.4.0"
+  version: "1.6.0"
 ---
 
 # Workflow review

package/src/builtins.ts

@@ -55,7 +55,7 @@ const plan = await agent(
   'You are planning web research for this question:\\n' + question +
   '\\n\\nProduce ' + angles + ' diverse, specific search queries that together cover the question from different angles. ' +
   'Use your web search tools when helpful to refine them.',
-  { label: 'plan queries', schema: { type: 'object', properties: { queries: { type: 'array', items: { type: 'string' } } }, required: ['queries'] } }
+  { label: 'plan queries', strength: 'medium', schema: { type: 'object', properties: { queries: { type: 'array', items: { type: 'string' } } }, required: ['queries'] } }
 )
 const planned = plan && Array.isArray(plan.queries) ? plan.queries.filter((q) => typeof q === 'string' && q.trim().length > 0) : []
 const queries = (planned.length > 0 ? planned : [question]).slice(0, angles)
@@ -67,7 +67,7 @@ const gathered = await parallel(queries.map((q, i) => () =>
     '\\n\\nSteps: (1) run a web search for the query; (2) fetch the most relevant result URLs; ' +
     '(3) extract concrete, verifiable factual claims, each tagged with the exact source URL it came from. ' +
     'Do NOT invent sources or claims — report only what the fetched pages actually say.',
-    { label: 'research ' + (i + 1), schema: { type: 'object', properties: { sources: { type: 'array', items: { type: 'object', properties: { url: { type: 'string' }, claims: { type: 'array', items: { type: 'string' } } }, required: ['url', 'claims'] } } }, required: ['sources'] } }
+    { label: 'research ' + (i + 1), strength: 'low', schema: { type: 'object', properties: { sources: { type: 'array', items: { type: 'object', properties: { url: { type: 'string' }, claims: { type: 'array', items: { type: 'string' } } }, required: ['url', 'claims'] } } }, required: ['sources'] } }
   )
 ))
 const allSources = gathered.filter(Boolean).flatMap((g) => (g && g.sources) || [])
@@ -77,7 +77,7 @@ const verdict = await agent(
   'Cross-check these research sources. Group claims that assert the same fact across different source URLs. ' +
   'Keep a claim only if it is supported by at least ' + minSupport + ' distinct source URLs OR by one clearly authoritative source. ' +
   'Discard claims found in a single weak source or that conflict with others.\\n\\nSOURCES JSON:\\n' + JSON.stringify(allSources),
-  { label: 'cross-check', schema: { type: 'object', properties: { supported: { type: 'array', items: { type: 'object', properties: { claim: { type: 'string' }, sources: { type: 'array', items: { type: 'string' } } }, required: ['claim', 'sources'] } }, discarded: { type: 'array', items: { type: 'string' } } }, required: ['supported'] } }
+  { label: 'cross-check', strength: 'medium', schema: { type: 'object', properties: { supported: { type: 'array', items: { type: 'object', properties: { claim: { type: 'string' }, sources: { type: 'array', items: { type: 'string' } } }, required: ['claim', 'sources'] } }, discarded: { type: 'array', items: { type: 'string' } } }, required: ['supported'] } }
 )
 
 phase('Report')
@@ -85,7 +85,7 @@ const report = await agent(
   'Write a concise, well-structured research report that answers the question using ONLY the supported claims below. ' +
   'Cite source URLs inline next to each claim. If the evidence is thin, say so explicitly.\\n\\n' +
   'QUESTION: ' + question + '\\n\\nSUPPORTED CLAIMS JSON:\\n' + JSON.stringify((verdict && verdict.supported) || []),
-  { label: 'write report' }
+  { label: 'write report', strength: 'medium' }
 )
 
 return { question, queries, supported: (verdict && verdict.supported) || [], report }`;
@@ -107,7 +107,7 @@ const threshold = (args && args.threshold) || 0.5
 phase('Investigate')
 const investigation = await agent(
   'Investigate the following and list concrete, individually-checkable findings:\\n' + task,
-  { label: 'investigate', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }
+  { label: 'investigate', strength: 'medium', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }
 )
 const findings = (investigation && Array.isArray(investigation.findings) ? investigation.findings : [])
 
@@ -118,7 +118,7 @@ const judged = await parallel(findings.map((f, i) => () =>
       'You are a skeptical reviewer. Try to REFUTE this finding for the task below. ' +
       'Default to real=false when uncertain. Investigate with the available tools if needed.\\n\\n' +
       'TASK: ' + task + '\\nFINDING: ' + f,
-      { label: 'refute ' + (i + 1) + '.' + (r + 1), schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real'] } }
+      { label: 'refute ' + (i + 1) + '.' + (r + 1), strength: 'low', schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real'] } }
     )
   )).then((votes) => {
     const valid = votes.filter(Boolean)
@@ -134,7 +134,7 @@ const report = await agent(
   'Synthesize the surviving findings into a concise review. For each finding, note the skeptic agreement ' +
   '(realVotes/totalVotes). Do not include findings that failed the refutation pass.\\n\\n' +
   'TASK: ' + task + '\\n\\nSURVIVING FINDINGS JSON:\\n' + JSON.stringify(survivors),
-  { label: 'consensus report' }
+  { label: 'consensus report', strength: 'medium' }
 )
 
 return { findings, judged: judged.filter(Boolean), survivors, report }`;
@@ -154,13 +154,13 @@ const diffSource = (args && args.diffSource) || 'provided diff'
 
 phase('Scan')
 const finders = await parallel([
-  () => agent('You are a correctness reviewer. Find bugs, race conditions, error-handling gaps, and edge-case failures in this diff.\\n\\n' + diff, { label: 'correctness', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
-  () => agent('You are a reuse reviewer. Find duplicated logic, reinvented wheels, and missed opportunities to reuse existing code or libraries.\\n\\n' + diff, { label: 'reuse', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
-  () => agent('You are a simplification reviewer. Find over-engineering, unnecessary complexity, and simpler alternatives.\\n\\n' + diff, { label: 'simplification', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
-  () => agent('You are an efficiency reviewer. Find performance problems, avoidable allocations, and scaling risks.\\n\\n' + diff, { label: 'efficiency', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
-  () => agent('You are an architecture reviewer. Assess the change at the right altitude: design fit, layering, boundaries, and future maintenance.\\n\\n' + diff, { label: 'altitude', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
-  () => agent('You are a security reviewer. Find trust-boundary, injection, secret-leak, permission, and unsafe-input risks in this diff.\\n\\n' + diff, { label: 'security', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
-  () => agent('You are a testability reviewer. Find missing regression tests, observability gaps, and rollout/recovery risks in this diff.\\n\\n' + diff, { label: 'testability', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are a correctness reviewer. Find bugs, race conditions, error-handling gaps, and edge-case failures in this diff.\\n\\n' + diff, { label: 'correctness', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are a reuse reviewer. Find duplicated logic, reinvented wheels, and missed opportunities to reuse existing code or libraries.\\n\\n' + diff, { label: 'reuse', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are a simplification reviewer. Find over-engineering, unnecessary complexity, and simpler alternatives.\\n\\n' + diff, { label: 'simplification', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are an efficiency reviewer. Find performance problems, avoidable allocations, and scaling risks.\\n\\n' + diff, { label: 'efficiency', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are an architecture reviewer. Assess the change at the right altitude: design fit, layering, boundaries, and future maintenance.\\n\\n' + diff, { label: 'altitude', strength: 'medium', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are a security reviewer. Find trust-boundary, injection, secret-leak, permission, and unsafe-input risks in this diff.\\n\\n' + diff, { label: 'security', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
+  () => agent('You are a testability reviewer. Find missing regression tests, observability gaps, and rollout/recovery risks in this diff.\\n\\n' + diff, { label: 'testability', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } } }, required: ['findings'] } }),
 ])
 const candidates = finders.filter(Boolean).flatMap((f) => (f && f.findings) || [])
 
@@ -168,7 +168,7 @@ phase('Verify')
 const verified = await parallel(candidates.map((finding, i) => () =>
   agent('You are a skeptical verifier. For this candidate finding, check whether it is a REAL issue in the diff. ' +
     'Default to real=false when uncertain.\\n\\nCANDIDATE: ' + finding + '\\n\\nDIFF:\\n' + diff,
-    { label: 'verify ' + (i + 1), schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real'] } })
+    { label: 'verify ' + (i + 1), strength: 'low', schema: { type: 'object', properties: { real: { type: 'boolean' }, reason: { type: 'string' } }, required: ['real'] } })
 ))
 
 phase('Report')
@@ -179,7 +179,7 @@ const report = await agent(
   'Write a ranked code review report for this diff (' + diffSource + '). ' +
   'Include only verified findings, ordered by severity, each with a concrete location and fix suggestion.\\n\\n' +
   'VERIFIED FINDINGS JSON:\\n' + JSON.stringify(ranked),
-  { label: 'final report' }
+  { label: 'final report', strength: 'medium' }
 )
 
 return { candidates, ranked, report }`;
@@ -199,13 +199,13 @@ const perspectives = (args && Array.isArray(args.perspectives) && args.perspecti
 phase('Perspectives')
 const views = await parallel(perspectives.map((p, i) => () =>
   agent('Evaluate this topic from the perspective of: ' + p + '. Be concrete and specific; note risks, trade-offs, and what matters most from this angle.\\n\\nTOPIC: ' + topic,
-    { label: 'perspective ' + (i + 1), schema: { type: 'object', properties: { angle: { type: 'string' }, points: { type: 'array', items: { type: 'string' } }, risks: { type: 'array', items: { type: 'string' } } }, required: ['angle', 'points', 'risks'] } })
+    { label: 'perspective ' + (i + 1), strength: 'low', schema: { type: 'object', properties: { angle: { type: 'string' }, points: { type: 'array', items: { type: 'string' } }, risks: { type: 'array', items: { type: 'string' } } }, required: ['angle', 'points', 'risks'] } })
 ))
 
 phase('Synthesis')
 const synthesis = await agent(
   'Synthesize these perspectives into a balanced assessment. Identify where perspectives agree, where they conflict, and give a bottom-line recommendation with the key trade-offs.\\n\\nTOPIC: ' + topic + '\\n\\nPERSPECTIVES JSON:\\n' + JSON.stringify(views.filter(Boolean)),
-  { label: 'synthesis' }
+  { label: 'synthesis', strength: 'medium' }
 )
 
 return { views: views.filter(Boolean), synthesis }`;
@@ -229,21 +229,21 @@ const map = await agent(
   'Explore the codebase at ' + root + ' and produce a structural map: top-level modules, entry points, ' +
   'data flow, and where complexity concentrates. Use the available file tools.\\n' +
   (focus ? 'Focus/checks requested: ' + focus + '\\n' : ''),
-  { label: 'map', schema: { type: 'object', properties: { modules: { type: 'array', items: { type: 'object', properties: { name: { type: 'string' }, purpose: { type: 'string' }, risk: { type: 'string' } }, required: ['name', 'purpose'] } }, entryPoints: { type: 'array', items: { type: 'string' } }, complexityHotspots: { type: 'array', items: { type: 'string' } } }, required: ['modules'] } }
+  { label: 'map', strength: 'medium', schema: { type: 'object', properties: { modules: { type: 'array', items: { type: 'object', properties: { name: { type: 'string' }, purpose: { type: 'string' }, risk: { type: 'string' } }, required: ['name', 'purpose'] } }, entryPoints: { type: 'array', items: { type: 'string' } }, complexityHotspots: { type: 'array', items: { type: 'string' } } }, required: ['modules'] } }
 )
 
 phase('Audit')
 const audits = await parallel([
-  () => agent('Audit this codebase for correctness risks: error handling, boundary conditions, concurrency, security. Use file tools.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map), { label: 'correctness', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } }, severity: { type: 'string' } }, required: ['findings'] } }),
-  () => agent('Audit this codebase for maintainability: coupling, duplication, naming, test coverage, documentation. Use file tools.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map), { label: 'maintainability', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } }, severity: { type: 'string' } }, required: ['findings'] } }),
-  () => agent('Audit this codebase for operational health: dependencies, build, deployment, observability, secrets handling. Use file tools.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map), { label: 'operations', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } }, severity: { type: 'string' } }, required: ['findings'] } }),
+  () => agent('Audit this codebase for correctness risks: error handling, boundary conditions, concurrency, security. Use file tools.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map), { label: 'correctness', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } }, severity: { type: 'string' } }, required: ['findings'] } }),
+  () => agent('Audit this codebase for maintainability: coupling, duplication, naming, test coverage, documentation. Use file tools.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map), { label: 'maintainability', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } }, severity: { type: 'string' } }, required: ['findings'] } }),
+  () => agent('Audit this codebase for operational health: dependencies, build, deployment, observability, secrets handling. Use file tools.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map), { label: 'operations', strength: 'low', schema: { type: 'object', properties: { findings: { type: 'array', items: { type: 'string' } }, severity: { type: 'string' } }, required: ['findings'] } }),
 ])
 
 phase('Report')
 const report = await agent(
   'Write a codebase health audit report: overall health score, ranked findings across dimensions with concrete locations, ' +
   'and a prioritized remediation roadmap.\\n\\nSTRUCTURE:\\n' + JSON.stringify(map) + '\\n\\nAUDITS JSON:\\n' + JSON.stringify(audits.filter(Boolean)),
-  { label: 'audit report' }
+  { label: 'audit report', strength: 'medium' }
 )
 
 return { map, audits: audits.filter(Boolean), report }`;

package/src/capabilities.ts

@@ -29,11 +29,19 @@ export interface CapabilityEntry {
 }
 
 /** The contract format version. Bump on any breaking surface change. */
-export const WORKFLOW_CAPABILITY_CONTRACT_VERSION = "1.0.0";
+export const WORKFLOW_CAPABILITY_CONTRACT_VERSION = "2.0.0";
 
 /**
  * The runtime globals a script can rely on. `options` documents each helper's
  * accepted inputs with defaults; `constraints` states the behavioral contract.
+ *
+ * The strength option's type is spelled out on each of the four helpers that
+ * take it, rather than derived from `WORKFLOW_STRENGTHS`, because this array
+ * must stay literal-only: `check:capabilities` evaluates it in an empty VM
+ * realm so the published contract can be read without executing this package.
+ * `strengths.test.ts` pins the four copies against the vocabulary the runtime
+ * enforces, which is the drift protection a shared constant would otherwise
+ * have provided.
  */
 export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
   {
@@ -44,8 +52,12 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
       { name: "label", kind: "string", optional: true, default: "derived from phase and call count" },
       { name: "phase", kind: "string", optional: true, default: "current phase" },
       { name: "schema", kind: "plain JSON Schema", optional: true, default: "none" },
-      { name: "model", kind: "string", optional: true, default: "pi-subagents model resolver" },
-      { name: "tier", kind: "small|medium|large", optional: true, default: "pi-subagents workflow tier" },
+      {
+        name: "strength",
+        kind: '"low" | "medium" | "high"',
+        optional: true,
+        default: "no tier is sent; the agent's own tier, else agentTiers.defaultTier",
+      },
       { name: "isolation", kind: '"worktree"', optional: true, default: "pi-subagents worktree policy" },
       { name: "thread", kind: "string", optional: true, default: "fresh session per call" },
       { name: "toolset", kind: "string", optional: true, default: "configured host/agent toolset hint" },
@@ -60,9 +72,15 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
       "resume replays only the longest unchanged prefix; the first miss and every later call execute live",
       "replayed calls do not consume the real-dispatch maxAgents or token/phase budgets",
       "spawnKeys rotate by generation on resume so pi-subagents never raises a fingerprint conflict",
-      "explicit model is resolved and scope-checked by pi-subagents; unavailable selectors fail closed",
+      "strength is this package's own vocabulary, not an agentTiers key; a word outside low/medium/high is rejected before dispatch",
+      "a strengths table alone binds a strength to an agent tier; an unmapped strength dispatches with no tier and takes the agent's own default",
+      "a call that names no strength also dispatches with no tier; there is no default strength, so an unlabelled call never outranks the agent type's own tier",
+      "an unconfigured host uses a shipped default table: each strength on the catalogue tier of the same name, where the host defines one",
+      "resolveAgentTier in pi-subagents owns model, thinking, clamping, availability, and the resolution snapshot",
+      "there is no per-call model, thinking, or tier: a strength is the only model policy a workflow can express",
       "same-thread calls must be sequential and preserve a stable workflow thread name",
       "threads cannot be combined with worktree isolation",
+      "an option name outside this list is rejected before dispatch, not ignored; tier, model, and thinking name their replacement",
     ],
   },
   {
@@ -130,6 +148,7 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
       { name: "reviewers", kind: "number", optional: true, default: "2" },
       { name: "threshold", kind: "number", optional: true, default: "0.5" },
       { name: "lens", kind: "string | string[]", optional: true, default: "none" },
+      { name: "strength", kind: '"low" | "medium" | "high"', optional: true, default: '"low"' },
     ],
     constraints: ["threshold comparison is inclusive; real is false when no reviewer succeeds"],
   },
@@ -140,6 +159,7 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
     options: [
       { name: "judges", kind: "number", optional: true, default: "3" },
       { name: "rubric", kind: "string", optional: true, default: "overall quality and correctness" },
+      { name: "strength", kind: '"low" | "medium" | "high"', optional: true, default: '"low"' },
     ],
     constraints: ["highest mean score wins with stable input index as the tie-break; empty input returns undefined"],
   },
@@ -158,8 +178,8 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
   {
     name: "completenessCheck",
     classification: "runtime-global",
-    signature: "completenessCheck(taskArgs, results) => Promise<{ complete, missing? } | null>",
-    options: [],
+    signature: "completenessCheck(taskArgs, results, options?) => Promise<{ complete, missing? } | null>",
+    options: [{ name: "strength", kind: '"low" | "medium" | "high"', optional: true, default: '"medium"' }],
     constraints: ["only the first 4,000 characters of serialized result evidence are sent to the critic"],
   },
   {
@@ -193,6 +213,7 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
     constraints: [
       "consumes one agent slot and no tokens",
       "journaled answers replay only within an unchanged resume prefix",
+      "an option name outside this list is rejected rather than ignored, since a dropped headless silently auto-approves",
     ],
   },
   { name: "log", classification: "runtime-global", signature: "log(message) => void", options: [], constraints: [] },
@@ -308,6 +329,7 @@ export const WORKFLOW_CAPABILITIES: readonly CapabilityEntry[] = [
     constraints: [
       "must be the first statement",
       "name and description must be nonblank literals",
+      "workflow meta and phase metadata cannot contain model or thinking fields",
       "spread, computed keys, methods, template interpolation, and __proto__/constructor/prototype are rejected",
     ],
   },