@staix/agent-hub 0.12.33 → 0.12.35

package/src/hub/snapshots.ts

@@ -216,6 +216,7 @@ export class Turns {
     // ponytail: rows of finished tasks stay (a few per file per task); prune by task state if hub.db ever grows.
     this.db.run("CREATE TABLE IF NOT EXISTS touches (task INTEGER NOT NULL, peer TEXT NOT NULL, path TEXT NOT NULL, at INTEGER NOT NULL, PRIMARY KEY (task, peer, path))");
     this.db.run("CREATE INDEX IF NOT EXISTS touches_path ON touches (path)"); // the PreToolUse hook looks up one path
+    this.db.run("CREATE TABLE IF NOT EXISTS turn_workspaces (turn TEXT PRIMARY KEY, root TEXT NOT NULL, start_tree TEXT, end_tree TEXT, changed TEXT NOT NULL DEFAULT '[]')");
     this.db.run("CREATE TABLE IF NOT EXISTS task_snapshots (task INTEGER NOT NULL, proposed_at INTEGER NOT NULL, start_tree TEXT, PRIMARY KEY (task, proposed_at))");
   }
   /** A proposal's original project snapshot; task ids may be reused after reset. Never repair a missing baseline later. */
@@ -231,27 +232,55 @@ export class Turns {
       throw error;
     }
   }
-  begin(id: string, peer: string, startTree: string | undefined): void {
-    this.db.query("INSERT OR REPLACE INTO turns (id, peer, started, start_tree) VALUES (?, ?, ?, ?)").run(id, peer, Date.now(), startTree ?? null);
+  begin(id: string, peer: string, startTree: string | undefined, workspace?: string): void {
+    this.db.transaction(() => {
+      this.db.query("INSERT OR REPLACE INTO turns (id, peer, started, start_tree) VALUES (?, ?, ?, ?)").run(id, peer, Date.now(), workspace === undefined ? startTree ?? null : null);
+      this.db.query("DELETE FROM turn_workspaces WHERE turn = ?").run(id);
+      if (workspace !== undefined) this.db.query("INSERT INTO turn_workspaces (turn, root, start_tree) VALUES (?, ?, ?)").run(id, workspace, startTree ?? null);
+    })();
+  }
+  /** Only new extra-instance turns carry this evidence; absence preserves legacy external-peer workspace semantics. */
+  workspace(id: string): string | undefined {
+    try {
+      const row = this.db.query("SELECT root FROM turn_workspaces WHERE turn = ?").get(id) as { root: string } | null;
+      if (row && (typeof row.root !== "string" || !row.root)) throw new Error("invalid turn workspace evidence");
+      return row?.root;
+    } catch (error) {
+      if (/no such table/.test((error as Error).message)) return undefined;
+      throw error;
+    }
+  }
+  private snapshotFields<T extends { id: string; start_tree: string | null; end_tree: string | null; changed: string }>(row: T): T {
+    if (this.workspace(row.id) === undefined) return row;
+    const fields = this.db.query("SELECT start_tree, end_tree, changed FROM turn_workspaces WHERE turn = ?").get(row.id) as { start_tree: string | null; end_tree: string | null; changed: string };
+    return { ...row, ...fields };
   }
   /** The first native turn of a hub turn: reverting the conversation drops it and every later one. */
   native(id: string, native: string): void {
     this.db.query("UPDATE turns SET native = ? WHERE id = ? AND native IS NULL").run(native, id);
   }
   end(id: string, endTree: string | undefined, changed: string[], keep: number): void {
-    this.db.query("UPDATE turns SET ended = ?, end_tree = ?, changed = ? WHERE id = ?").run(Date.now(), endTree ?? null, JSON.stringify(changed), id);
+    this.db.transaction(() => {
+      const scoped = this.workspace(id) !== undefined;
+      // Older CLIs do not know workspace receipts. Leave their canonical-checkout snapshot view unknown.
+      this.db.query("UPDATE turns SET ended = ?, end_tree = ?, changed = ? WHERE id = ?").run(Date.now(), scoped ? null : endTree ?? null, scoped ? "[]" : JSON.stringify(changed), id);
+      if (scoped) this.db.query("UPDATE turn_workspaces SET end_tree = ?, changed = ? WHERE turn = ?").run(endTree ?? null, JSON.stringify(changed), id);
+    })();
     const peer = (this.db.query("SELECT peer FROM turns WHERE id = ?").get(id) as { peer: string } | null)?.peer;
     if (peer) this.db.query("DELETE FROM turns WHERE peer = ? AND id NOT IN (SELECT id FROM turns WHERE peer = ? ORDER BY started DESC, rowid DESC LIMIT ?)").run(peer, peer, keep);
+    this.db.run("DELETE FROM turn_workspaces WHERE turn NOT IN (SELECT id FROM turns)");
   }
   list(peer?: string, limit = 20): TurnRecord[] {
     const rows = (peer
       ? this.db.query("SELECT * FROM turns WHERE peer = ? ORDER BY started DESC, rowid DESC LIMIT ?").all(peer, limit)
       : this.db.query("SELECT * FROM turns ORDER BY started DESC, rowid DESC LIMIT ?").all(limit)) as (Omit<TurnRecord, "changed"> & { changed: string })[];
-    return rows.map((r) => ({ ...r, changed: JSON.parse(r.changed) as string[] }));
+    return rows.map(row => this.snapshotFields(row)).map((r) => ({ ...r, changed: JSON.parse(r.changed) as string[] }));
   }
   get(id: string): TurnRecord | undefined {
     const r = this.db.query("SELECT * FROM turns WHERE id = ?").get(id) as (Omit<TurnRecord, "changed"> & { changed: string }) | null;
-    return r ? { ...r, changed: JSON.parse(r.changed) as string[] } : undefined;
+    if (!r) return undefined;
+    const record = this.snapshotFields(r);
+    return { ...record, changed: JSON.parse(record.changed) as string[] };
   }
   /**
    * Other peers' turns that overlapped this one in time: their changes are in this turn's diff too. `unknown` lists
@@ -263,21 +292,23 @@ export class Turns {
   // before" time in Turns.end if that ever matters.
   overlapping(turn: TurnRecord, keep: number): { paths: string[]; unknown: string[] } {
     const rows = this.db.query("SELECT id, changed, ended, start_tree, end_tree FROM turns WHERE id != ? AND peer != ? AND started < ? AND (ended IS NULL OR ended > ?)").all(turn.id, turn.peer, turn.ended ?? Date.now(), turn.started) as { id: string; changed: string; ended: number | null; start_tree: string | null; end_tree: string | null }[];
-    const known = rows.filter((r) => r.ended !== null && r.start_tree !== null && r.end_tree !== null);
+    const scopedRows = rows.map(row => this.snapshotFields(row));
+    const known = scopedRows.filter((r) => r.ended !== null && r.start_tree !== null && r.end_tree !== null);
     const pruned = (this.db.query("SELECT peer, MIN(started) AS oldest FROM turns WHERE peer != ? GROUP BY peer HAVING COUNT(*) >= ?").all(turn.peer, keep) as { peer: string; oldest: number }[])
       .filter((p) => p.oldest > turn.started)
       .map((p) => `${p.peer} (its turns from then were pruned)`);
-    return { paths: [...new Set(known.flatMap((r) => JSON.parse(r.changed) as string[]))], unknown: [...rows.filter((r) => !known.includes(r)).map((r) => r.id), ...pruned] };
+    return { paths: [...new Set(known.flatMap((r) => JSON.parse(r.changed) as string[]))], unknown: [...scopedRows.filter((r) => !known.includes(r)).map((r) => r.id), ...pruned] };
   }
 
   /** Other peers' completed, snapshotted turns that overlapped this turn and changed at least one of the same files. */
   concurrentWith(turn: TurnRecord): TurnRecord[] {
     if (turn.ended === null || turn.start_tree === null || turn.end_tree === null || !turn.changed.length) return [];
     const rows = this.db.query(`SELECT * FROM turns WHERE id != ? AND peer != ? AND started < ? AND ended > ?
-      AND start_tree IS NOT NULL AND end_tree IS NOT NULL ORDER BY started, rowid`)
+      ORDER BY started, rowid`)
       .all(turn.id, turn.peer, turn.ended, turn.started) as (Omit<TurnRecord, "changed"> & { changed: string })[];
     const changed = new Set(turn.changed);
-    return rows.map((r) => ({ ...r, changed: JSON.parse(r.changed) as string[] }))
+    return rows.map(row => this.snapshotFields(row)).filter(row => row.start_tree !== null && row.end_tree !== null)
+      .map((r) => ({ ...r, changed: JSON.parse(r.changed) as string[] }))
       .filter((other) => other.changed.some((path) => changed.has(path)));
   }
 

package/src/hub/start-mode.ts

@@ -1,4 +1,4 @@
-import { SUPPORTED_PEERS, isSupportedPeer } from "./peer-catalog.ts";
+import { definitionOf, SUPPORTED_PEERS, START_MODE_PEERS as REGISTRY_START_MODE_PEERS, type KindMap } from "../adapters/registry.ts";
 
 /**
  * #269: how a peer comes up when the hub starts it: its own TUI in a terminal, or headless. A person who types
@@ -8,34 +8,39 @@ import { SUPPORTED_PEERS, isSupportedPeer } from "./peer-catalog.ts";
 export const PEER_START_RETRY_MS = 30_000;
 export const START_MODES = ["tui", "headless"] as const;
 export type StartMode = typeof START_MODES[number];
+// ponytail: released coordinators source-probe this exact literal before restoring headless Kimi.
+// Keep it until those readers negotiate the registry capability.
 /** The peers with both forms. Kimi's TUI is pull-only; Claude has only a TUI and local only headless. */
 export const START_MODE_PEERS = ["pi", "codex", "kimi"] as const;
 /** Every peer the hub can start itself. */
 export const STARTABLE_PEERS = SUPPORTED_PEERS;
 export type StartablePeer = typeof STARTABLE_PEERS[number];
-export const isStartablePeer = (value: unknown): value is StartablePeer => isSupportedPeer(value);
+export const isStartablePeer = (value: unknown): value is StartablePeer => typeof value === "string" && !!definitionOf(value)?.start.conductorStartable;
+
 
 export type PeerStartConfig = Record<string, { start_mode?: StartMode }>;
 /** The checked per-peer start modes; only peers with both forms may be configured. */
-export function peerStartConfig(value: unknown): PeerStartConfig {
+export function peerStartConfig(value: unknown, instances?: KindMap): PeerStartConfig {
   if (value === undefined) return {};
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("peers must be an object of per-peer settings");
   const result: PeerStartConfig = {};
   for (const [peer, block] of Object.entries(value)) {
-    if (!(START_MODE_PEERS as readonly string[]).includes(peer)) throw new Error(`peers.${peer}: only ${START_MODE_PEERS.join(" and ")} have a start mode`);
+    const extra = definitionOf(peer, instances)?.kind !== peer && !!definitionOf(peer, instances);
+    if (!(REGISTRY_START_MODE_PEERS as readonly string[]).includes(peer) && !extra) throw new Error(`peers.${peer}: only ${REGISTRY_START_MODE_PEERS.join(" and ")} have a start mode`);
     if (!block || typeof block !== "object" || Array.isArray(block)) throw new Error(`peers.${peer} must be an object`);
     const mode = (block as { start_mode?: unknown }).start_mode;
     if (mode !== undefined && !(START_MODES as readonly unknown[]).includes(mode)) throw new Error(`peers.${peer}.start_mode must be tui or headless`);
+    if (extra && mode !== undefined && mode !== "headless") throw new Error(`peers.${peer}.start_mode: extra instances require headless mode in I2`);
     result[peer] = mode === undefined ? {} : { start_mode: mode as StartMode };
   }
   return result;
 }
 
 /** The mode a start of `peer` takes when nothing more specific was asked: `tui` wherever the peer has one. */
-export function startModeOf(peers: PeerStartConfig | undefined, peer: string): StartMode {
-  if (peer === "claude") return "tui";
-  if ((START_MODE_PEERS as readonly string[]).includes(peer)) return peers?.[peer]?.start_mode ?? "tui";
-  return "headless";
+export function startModeOf(peers: PeerStartConfig | undefined, peer: string, instances?: KindMap): StartMode {
+  if (definitionOf(peer, instances)?.kind !== peer && definitionOf(peer, instances)) return peers?.[peer]?.start_mode ?? "headless";
+  if ((REGISTRY_START_MODE_PEERS as readonly string[]).includes(peer)) return peers?.[peer]?.start_mode ?? definitionOf(peer)?.start.defaultForm ?? "tui";
+  return definitionOf(peer)?.start.defaultForm ?? "headless";
 }
 
 /**

package/src/hub/status-roster.ts

@@ -0,0 +1,8 @@
+// No imports: native CLI entries load this from inside the adapter registry's import graph (#484).
+/** A peer's membership from a `status` reply: undefined when the hub sends no roster (older than #484), never read as off. */
+export function rosterInStatus(status: unknown, peer: string): boolean | undefined {
+  const rows = (status as { roster?: unknown } | undefined)?.roster;
+  if (!Array.isArray(rows)) return undefined;
+  const row = rows.find((r: unknown) => !!r && typeof r === "object" && (r as { peer?: unknown }).peer === peer) as { on?: unknown } | undefined;
+  return typeof row?.on === "boolean" ? row.on : undefined;
+}

package/src/hub/tasks.ts

@@ -1,4 +1,6 @@
+import type { InstancesConfig } from "./instances.ts";
 import { composeRememberText } from "./memory-fail.ts";
+import { VERSION } from "../version.ts";
 import { readGitHubImport, type GitHubSource, type GitHubImportSelection } from "./github-import.ts";
 import { BACKLOG_SPLIT_SCREEN_TIMEOUT_MS, actualTaskDates, planningPatch, type PlanningFields, type Release, type ReleaseState } from "./planning.ts";
 import { readMergeQueue } from "./sdlc-queue.ts";
@@ -9,7 +11,7 @@ import { correctionInput, resolveVisibleMemory } from "./memory-candidates.ts";
 import type { MemoryScreen } from "./read-tools.ts";
 import { withoutPii, mentionsPrivatePath } from "./memory-policy.ts";
 import { profileClass, profileData, profileTaskLabel, projectProfile, type ProfileName, type ProfileSelection, type ProjectProfile } from "./profiles.ts";
-import { phaseView, validatePhaseLinks, workflowHash } from "./workflow.ts";
+import { criteriaView, workflowHash } from "./workflow.ts";
 import { isAbsolute, relative } from "node:path";
 import type { Briefs, NativeItem } from "../memory/brief.ts";
 import type { MemoryClient } from "../memory/client.ts";
@@ -18,14 +20,14 @@ import { CLASSES, OUTCOMES_KEPT_MS, ALL_PLAN_KEYS, TASK_MOVE_REASONS, taskHasSta
 import type { Bus } from "./bus.ts";
 import { HUB, newEnvelope, NOTE_KINDS, noteLine, sanitize, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
 import type { PiiVerdict, ScreenItem, ScreenRecord } from "./inference.ts";
-import { assign, detectSignals, LOCAL, peerEntry, PI, predictSplit, type Assignment, type PeerCapabilities, type Routing, type SplitObservation, type SplitPrediction } from "./routing.ts";
+import { assign, detectSignals, peerEntry, predictSplit, relayCandidates, type Assignment, type InstanceRoutingOptions, type PeerCapabilities, type Routing, type SplitObservation, type SplitPrediction } from "./routing.ts";
 import { ExecutionBudget, type ExecutionBudgetConfig, type ExecutionBudgetDecision, type ExecutionBudgetStatus, type ExecutionUnit } from "./execution-budget.ts";
 import { Cohorts, MAX_REQUESTS, type Cohort, type Completion } from "./cohorts.ts";
 import { realPath } from "./project.ts";
 import { PreEffectToolRefusal } from "./tool-refusal.ts";
-import { SUPPORTED_PEERS } from "./peer-catalog.ts";
+import { ADAPTERS, definitionOf } from "../adapters/registry.ts";
 import { nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
-import { readSdlcPr, sdlcConfig, sdlcReceipt, sdlcStatus, stageDefinition, lifecycleStage, type SdlcConfig, sdlcGh, type SdlcGh, type SdlcStatus } from "./sdlc.ts";
+import { checklistOf, readSdlcPr, sdlcConfig, sdlcReceipt, sdlcStatus, stageDefinition, lifecycleStage, type SdlcConfig, sdlcGh, type SdlcGh, type SdlcStatus } from "./sdlc.ts";
 
 export type TaskAssignmentRole = "owner" | "reviewer";
 
@@ -36,6 +38,10 @@ export interface TasksDeps {
   board: Board;
   bus: Bus;
   routing: () => Routing;
+  /** Startup-bound project declarations; routing never discovers instances from peer names. */
+  instances?: () => InstancesConfig;
+  /** Host proof of each live extra runtime's actual isolated execution root; config paths alone are not proof. */
+  ownerIsolation?: () => Readonly<Record<string, boolean>>;
   cwd: string;
   project: string;
   profile?: ProfileName;
@@ -125,9 +131,12 @@ export interface TasksDeps {
   sweep?: TaskSweepConfig;
   /** Shutdown or coordinator work holds task sweeps too. */
   sweepHeld?: () => boolean;
+  /** Consecutive changes_requested verdicts that move a task to another peer (`tasks.escalate_after`, #488). */
+  escalateAfter?: () => number;
 }
 
-const ESCALATE_AFTER = 2;
+/** The `tasks.escalate_after` default (#488): the third consecutive changes_requested escalates. */
+export const ESCALATE_AFTER = 3;
 // Demotion (issue #36): a failure counts half after a day. A peer is demoted for a class once its decayed failures
 // reach 1.5 (two within about half a day, three within two days) and outweigh its decayed successes there.
 // ponytail: fixed constants; make them config when someone needs to tune them.
@@ -505,19 +514,31 @@ export class Tasks {
     return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
   }
 
+  /** Workload is board/queue data only: wip() never calls health() or weights(). */
+  private instanceRouting(): InstanceRoutingOptions {
+    const instances = this.d.instances?.();
+    if (!instances || !Object.keys(instances).length) return {};
+    const peers = [...new Set([...ADAPTERS.map(adapter => adapter.kind), ...Object.keys(instances), ...this.d.bus.peers.keys()])];
+    return { instances, ownerIsolation: this.d.ownerIsolation?.() ?? {}, wip: Object.fromEntries(peers.map(peer => [peer, this.wip(peer)])), load: Object.fromEntries(peers.map(peer => [peer, this.d.bus.queued(peer)])) };
+  }
+
   /** Peer health and roles the daemon feeds routing (issues #89, #90, #92): failing peers are skipped, held queues explained. */
   private health() {
     const failing = this.d.failing?.();
     const held = this.d.held?.();
-    return { ...(this.d.capabilities ? { capabilities: this.d.capabilities(), repository: this.d.repository } : {}), pullOnly: [...this.d.bus.peers.values()].filter(peer => peer.id === "kimi" && peer.pullOnly).map(peer => peer.id), offRoster: SUPPORTED_PEERS.filter(peer => !this.d.bus.isRostered(peer)), ...(failing ? { failing } : {}), ...(held ? { held } : {}), ...(this.d.roles ? { roles: this.d.roles } : {}) };
+    const workload = this.instanceRouting();
+    const peers = workload.instances ? [...new Set([...ADAPTERS.map(adapter => adapter.kind), ...Object.keys(workload.instances), ...this.d.bus.peers.keys()])] : ADAPTERS.map(adapter => adapter.kind);
+    return { ...workload, ...(this.d.capabilities ? { capabilities: this.d.capabilities(), repository: this.d.repository } : {}), pullOnly: [...this.d.bus.peers.values()].filter(peer => definitionOf(peer.id, workload.instances)?.attach?.pullOnlyForms?.length && peer.pullOnly).map(peer => peer.id), offRoster: peers.filter(peer => !this.d.bus.isRostered(peer)), ...(failing ? { failing } : {}), ...(held ? { held } : {}), ...(this.d.roles ? { roles: this.d.roles } : {}) };
   }
 
   /** Capability admission precedes explicit assignments/reservations, independent of readiness or transient peer health. */
   private requireCapabilities(task: Parameters<typeof assign>[0], peer: PeerId, role: TaskAssignmentRole = "owner", preEffect = true): void {
-    if (!this.d.capabilities || this.isPii(task)) return;
+    const instances = this.d.instances?.(), adapter = definitionOf(peer, instances);
+    const declaredExtra = !!adapter && adapter.kind !== peer;
+    if ((!this.d.capabilities || this.isPii(task)) && !declaredExtra) return;
     const { state: _state, ...draft } = task; // backlog/readiness must not bypass an explicit reservation's admission
     const admission = assign(draft, this.states(), this.d.routing(), { candidates: role === "owner" ? [peer] : [], ...(role === "owner" ? { namedOwner: peer } : { namedReviewer: peer }), ...this.weights(task.class) });
-    const missing = (admission.refusals ?? []).filter(row => row.peer === peer && row.role === role && (row.code === "tests" || row.code === "spec")).map(row => `  ${role} candidate ${peer}: skipped, ${row.reason}`);
+    const missing = (admission.refusals ?? []).filter(row => row.peer === peer && row.role === role && (row.code === "tests" || row.code === "spec" || declaredExtra && role === "owner" && row.code === "owner-admission")).map(row => `  ${role} candidate ${peer}: skipped, ${row.reason}`);
     if (missing.length) throw new (preEffect ? PreEffectToolRefusal : Error)(`cannot assign ${peer}: ${missing.join("; ")}`);
   }
 
@@ -799,7 +820,7 @@ export class Tasks {
       if (by !== USER && Object.hasOwn(patch, "reserved") && this.hasPersonReservation(task)) throw new PreEffectToolRefusal("a person's reservation is retained");
       if (Object.hasOwn(patch, "deps") || Object.hasOwn(patch, "reserved")) {
         if (task.state !== "backlog" || taskHasStarted(task) || task.owner) throw new PreEffectToolRefusal("dependency and reservation changes require unstarted backlog work");
-        if (patch.reserved && !(SUPPORTED_PEERS as readonly string[]).includes(patch.reserved) && !this.d.bus.knownPeers().includes(patch.reserved) && !this.d.routing().classes[task.class]?.peers.includes(patch.reserved)) throw new PreEffectToolRefusal("reserved owner is not a supported or configured peer");
+        if (patch.reserved && !definitionOf(patch.reserved, this.d.instances?.()) && !this.d.bus.knownPeers().includes(patch.reserved) && !this.d.routing().classes[task.class]?.peers.includes(patch.reserved)) throw new PreEffectToolRefusal("reserved owner is not a supported or configured peer");
         if (patch.reserved && !this.d.bus.isRostered(patch.reserved)) throw new PreEffectToolRefusal("reserved owner is off roster");
         if (patch.reserved) this.requireCapabilities(task, patch.reserved);
         const rows = new Map(this.d.board.list().map(row => [row.id, row]));
@@ -1387,7 +1408,7 @@ export class Tasks {
 
   /** Same code as assignment, without doing it. `routing`: a candidate policy to explain under (the settings preview, #269). */
   explain(target: number | { title: string; detail?: string; class: TaskClass; refs?: TaskRefs }, routing: Routing = this.d.routing()): string[] {
-    const workflow = this.d.sdlc?.config().workflow === "gsd-lite" ? [`workflow: gsd-lite (${this.d.sdlc.config().mode}); checklist guidance, board dependencies authoritative`] : [];
+    const workflow = this.d.sdlc?.config().workflow === "gsd-lite" ? [`criteria checklist required on every task (retired gsd-lite setting, ${this.d.sdlc.config().mode}); board dependencies authoritative`] : [];
     if (typeof target === "number") {
       const task = this.d.board.get(target);
       if (!task) throw new Error(`no task #${target}`);
@@ -1458,6 +1479,10 @@ export class Tasks {
     if (hold) this.d.notify(`task ${this.publicTitle(task)}: ${a.owner}'s queue is held (${hold}); the task arrives once the hold is resolved`);
   }
 
+  private assignmentNote(note: string, assignment: Assignment): string {
+    return assignment.sameFamilyFallback ? `${note}; sameFamilyFallback=true` : note;
+  }
+
   /** A later move to another owner means the caller's assignment was superseded, so its success tail is not authoritative. */
   private ownOwnerMove(before: Task, after: Task, by: PeerId, event: string): boolean {
     const moves = (task: Task) => task.history.filter(entry => ["assigned", "reassigned", "escalated", "unassigned"].includes(entry.event));
@@ -1496,7 +1521,7 @@ export class Tasks {
     // A person's explicit assign replaces an agent's reservation (#207). Only a refusal keeps the owner it moves away from
     // out for good: a reviewer's rejections or an escalation by hand, never the hub's own move after a failed delivery.
     const lasting = opts.event === "escalated" && task.owner && (opts.reason === "rejections" || opts.reason === "manual");
-    const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, `${opts.note ?? `to ${a.owner}`}${passed}`, { ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) }, opts.expectedFlowRevision);
+    const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.roster && task.state === "in_progress" ? { state: "proposed" as const } : {}), ...(opts.event === "escalated" ? { rejections: 0 } : {}), ...(opts.override && task.reserved ? { reserved: null } : {}) }, this.assignmentNote(`${opts.note ?? `to ${a.owner}`}${passed}`, a), { ...(profile ? { profile } : {}), ...(opts.reason ? { reason: opts.reason } : {}), ...(lasting ? { from: task.owner! } : {}) }, opts.expectedFlowRevision);
     // What calibration reads (issue #109): routing chose the first owner (no single named candidate, no claim; not an
     // escalation, relay or reassignment of work already begun), and the work overlaps another owner's task not started
     // yet. For the record only. Work routed back to its proposer is left out, as its observations are (by === owner).
@@ -1596,7 +1621,7 @@ export class Tasks {
     const pii = this.isPii(task), delivery = { ...a, reviewer: task.reviewer ?? undefined };
     const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", delivery.owner, h.withheld)}`);
     const handoff = context && !pii ? this.screen(task, context, "handoff", delivery.owner, contextWithheld).slice(0, 3000) : "";
-    const facts = [`class ${profileTaskLabel(task)}`, delivery.owner === PI ? `backend pi/${delivery.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", delivery.reviewer ? `reviewer ${delivery.reviewer}` : task.class === "review" ? "no reviewer" : this.noReviewer(delivery)].filter(Boolean).join("; ");
+    const facts = [`class ${profileTaskLabel(task)}`, delivery.owner && definitionOf(delivery.owner, this.d.instances?.())?.routing?.backendLabel ? `backend ${definitionOf(delivery.owner, this.d.instances?.())!.routing!.backendLabel}/${delivery.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", delivery.reviewer ? `reviewer ${delivery.reviewer}` : task.class === "review" ? "no reviewer" : this.noReviewer(delivery)].filter(Boolean).join("; ");
     const plan = planText(task.plan);
     const body = [
       `Task #${task.id} [${profileTaskLabel(task)}] ${task.title}`,
@@ -1710,7 +1735,9 @@ export class Tasks {
   }
   private ownerStallCause(task: Task, admission: Assignment): TaskStall["cause"] {
     const refusal = admission.refusals?.find(row => row.role === "owner" && row.peer === task.reserved);
-    return refusal ? { kind: "reservation", peer: refusal.peer, code: refusal.code } : { kind: "no-eligible-peer", code: "unavailable", refusals: admission.refusals?.filter(row => row.role === "owner").map(({ peer, code }) => ({ peer, code })).sort((a, b) => a.peer.localeCompare(b.peer)) ?? [] };
+    // Persist the existing stall vocabulary; the assignment/explain keeps the precise instance/family refusal.
+    const persisted = (code: NonNullable<Assignment["refusals"]>[number]["code"]): TaskStall["cause"]["code"] => code === "instance" || code === "family" ? "policy" : code;
+    return refusal ? { kind: "reservation", peer: refusal.peer, code: persisted(refusal.code) } : { kind: "no-eligible-peer", code: "unavailable", refusals: admission.refusals?.filter(row => row.role === "owner").map(({ peer, code }) => ({ peer, code: persisted(code) })).sort((a, b) => a.peer.localeCompare(b.peer)) ?? [] };
   }
   private reportStall(task: Task, cause: TaskStall["cause"], now = Date.now()): void {
     const stall: TaskStall = { task: task.id, cause, signature: JSON.stringify(cause), replanRevision: task.planningRevision ?? 0, at: now };
@@ -1813,17 +1840,18 @@ export class Tasks {
     const task = this.need(id, false, true);
     if (by !== USER && by !== task.owner && by !== task.reviewer) throw new PreEffectToolRefusal("only the task owner, reviewer or console user may record lifecycle evidence");
     const config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
-    const next = sdlcReceipt(input, task.sdlc, config);
+    const next = sdlcReceipt(input, task.sdlc, config, VERSION);
     const definition = stageDefinition(config, next.stage);
     if (config.mode === "enforce" && config.definitions && input && typeof input === "object" && "stage" in input && next.stage !== task.sdlc?.stage && by !== USER) {
       const actor = definition?.actor;
       const acts = actor === "owner" ? by === task.owner : actor === "reviewer" ? by === task.reviewer : actor === "planner" ? this.d.roles?.[by]?.includes("planner") : actor === "owner/planner" && (by === task.owner || this.d.roles?.[by]?.includes("planner"));
       if (!acts) throw new PreEffectToolRefusal(`lifecycle stage requires its ${actor ?? "unknown"} actor or the person`);
     }
-    if (input && typeof input === "object" && "phase" in input) {
+    if (input && typeof input === "object" && ("criteria" in input || "phase" in input)) {
       this.mine(task, by, "reviewer", true);
-      if (next.phase && !this.isPii(task) && !this.nameable(JSON.stringify(next.phase))) throw new PreEffectToolRefusal("phase metadata matches a PII pattern; use private work");
-      if (next.phase) validatePhaseLinks(task, next.phase, id => this.d.board.get(id), t => this.isPii(t));
+      // Screen whichever name stored the checklist: off keeps the #257 phase key (#481 S8).
+      const checklist = checklistOf(next);
+      if (checklist && !this.isPii(task) && !this.nameable(JSON.stringify(checklist))) throw new PreEffectToolRefusal("checklist metadata matches a PII pattern; use private work");
     }
     // Recording a head is the reviewer's; a head dropped because the repo or PR changed is not a recording, and a
     // head supplied with a new PR identity is one even when its value is unchanged (#382).
@@ -1857,12 +1885,17 @@ export class Tasks {
   }
 
   private workflowView(task: Task) {
-    return phaseView(this.d.sdlc?.config() ?? sdlcConfig(undefined), task, id => this.d.board.get(id), t => this.isPii(t));
+    return criteriaView(this.d.sdlc?.config() ?? sdlcConfig(undefined), task, t => this.isPii(t));
   }
   workflowExport(id: unknown): Record<string, unknown> {
-    const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
-    const state = { id: task.id, state: task.state, stage: task.sdlc?.stage ?? config.stages[0] ?? "spec", ...(this.isPii(task) ? { private: true } : { phase: this.workflowView(task) ?? null }) };
-    return { schema: 1, workflow: config.workflow ?? "none", state, stateHash: workflowHash(state), sourceHash: workflowHash(config) };
+    const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined), stage = task.sdlc?.stage ?? config.stages[0] ?? "spec";
+    // Off keeps the #257 export bytes; schema 2 (criteria, no workflow framing) is for an enabled or retired-setting lifecycle.
+    if (config.mode === "off" && !config.workflow) {
+      const legacy = { id: task.id, state: task.state, stage, ...(this.isPii(task) ? { private: true } : { phase: null }) };
+      return { schema: 1, workflow: "none", state: legacy, stateHash: workflowHash(legacy), sourceHash: workflowHash(config) };
+    }
+    const state = { id: task.id, state: task.state, stage, ...(this.isPii(task) ? { private: true } : { criteria: this.workflowView(task) ?? null }) };
+    return { schema: 2, state, stateHash: workflowHash(state), sourceHash: workflowHash(config) };
   }
   async lifecycleStatus(id: unknown, refresh = true): Promise<SdlcStatus> {
     const task = this.need(id), config = this.d.sdlc?.config() ?? sdlcConfig(undefined);
@@ -2338,7 +2371,7 @@ export class Tasks {
     if (rejected.owner) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
     this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`, withheld);
-    if (rejected.rejections >= ESCALATE_AFTER) {
+    if (rejected.rejections >= (this.d.escalateAfter?.() ?? ESCALATE_AFTER)) {
       let moved: Task;
       try {
         moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`, "rejections");
@@ -2442,7 +2475,7 @@ export class Tasks {
       this.ready(task, preEffect);
       const a = assign(task, this.states(), this.d.routing(), { candidates: [], namedReviewer: peer, ...(task.owner ? { notReviewer: task.owner } : {}), ...this.weights(task.class) });
       if (a.reviewer !== peer) throw new (preEffect ? PreEffectToolRefusal : Error)(`cannot name ${peer} as reviewer: ${a.trace.filter(line => line.includes("reviewer") || line.includes("pii")).join("; ")}`);
-      const next = this.d.board.update(task.id, by, "reviewer changed", { reviewer: peer }, `named reviewer ${peer}`, { reason: "manual" }, expectedFlowRevision);
+      const next = this.d.board.update(task.id, by, "reviewer changed", { reviewer: peer }, this.assignmentNote(`named reviewer ${peer}`, a), { reason: "manual" }, expectedFlowRevision);
       if (next.state === "in_review" && task.reviewer && task.reviewer !== peer) {
         this.withdrawRoleRequest(task, next, "reviewer");
       }
@@ -2494,7 +2527,7 @@ export class Tasks {
       const owner = task.owner === peer;
       const weights = this.weights(task.class);
       const pii = this.isPii(task);
-      const candidates = owner ? [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter(p => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p) : [];
+      const candidates = owner ? relayCandidates(routing.classes[task.class]?.peers ?? [], pii, { ...this.instanceRouting(), states: this.states() }) : [];
       const a = assign(task, this.states(), routing, { ...weights, offRoster: [...(weights.offRoster ?? []), peer], exclude: [peer], excludeOwners: owner && this.plannerPullRecord(task)?.pull ? this.plannerFull(task) : [], candidates, ...(owner ? { waitsFor: this.waitsFor(task) } : task.owner ? { notReviewer: task.owner } : {}) });
       return { id: task.id, title: this.publicTitle(task), role: owner ? "owner" : "reviewer", to: (owner ? a.owner : a.reviewer) ?? null };
     });
@@ -2515,7 +2548,7 @@ export class Tasks {
       if (urgentOnly && !task.signals.includes("urgent")) continue;
       if (task.owner === peer && (OPEN.includes(task.state) || roster && task.state === "in_review")) {
         const pii = this.isPii(task);
-        const candidates = [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter((p) => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p);
+        const candidates = relayCandidates(routing.classes[task.class]?.peers ?? [], pii, { ...this.instanceRouting(), states: this.states() });
         if (this.plannerPullRecord(task)?.pull && !assign(task, this.states(), routing, { candidates, exclude: [...this.excluded(task), peer], excludeOwners: this.plannerFull(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) }).owner) continue;
         // Budget keeps its original release/unassign behaviour for ordinary work. Roster changes the state in
         // assignOwner's same owner write only after routing has found somebody to take it.
@@ -2543,7 +2576,7 @@ export class Tasks {
           this.releaseNotice(`task ${this.publicTitle(task)}: its reviewer ${peer} is off roster and nobody else can review; the reviewer stays ${peer}; use ahub review ${task.id}`);
           continue;
         }
-        const next = this.d.board.update(task.id, HUB, "reviewer changed", { reviewer }, why);
+        const next = this.d.board.update(task.id, HUB, "reviewer changed", { reviewer }, this.assignmentNote(why, a));
         moved.push({ id: task.id, title: this.publicTitle(task), to: reviewer, role: "reviewer" });
         if (next.state === "in_review" && reviewer && reviewer !== USER) {
           if (roster) this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${reviewer}`, () => this.sendReview(next, reviewer, `(${peer} was reviewing this and is off roster.)`));
@@ -2735,4 +2768,4 @@ export class Tasks {
   }
 }
 
-export { LOCAL };
+export { LOCAL } from "./routing.ts";

package/src/hub/text-projection.ts

@@ -54,7 +54,7 @@ export class TextProjections {
   private readonly warned = new Set<string>();
   /** Inputs whose full-budget conversion failed: the same bytes under the same command are not converted again. */
   private readonly failed = new Set<string>();
-  constructor(private readonly options: { cwd: string; stateDir: string; config: ProjectionConfig; deny?: string[]; readAllow?: string[]; log?: (line: string) => void }) {
+  constructor(private readonly options: { cwd: string; projectRoot?: string; stateDir: string; config: ProjectionConfig; deny?: string[]; readAllow?: string[]; log?: (line: string) => void }) {
     // Rooted at an empty system directory, not the project. The project guarantee: project file data is denied, then the
     // snapshot, the argv-named program/script files and the directory listings above an in-project script are granted, so
     // no other project file is readable (system, toolchain, home and local.read_allow paths outside the project remain granted).
@@ -105,7 +105,9 @@ export class TextProjections {
     try {
       if (deadline !== undefined && (!Number.isFinite(deadline) || deadline <= performance.now())) throw new Error("projection deadline");
       const rawHash = createHash("sha1").update(bytes).digest("hex"), rawBlob = createHash("sha1").update("blob " + bytes.length + "\0").update(bytes).digest("hex");
-      const inputHash = hash(bytes), configHash = commandFingerprint(this.options.cwd, argv), key = hash(inputHash + "\n" + configHash + "\n" + ext);
+      const inputHash = hash(bytes), commandHash = commandFingerprint(this.options.cwd, argv);
+      const configHash = this.options.projectRoot === undefined ? commandHash : hash(commandHash + "\nproject-root:" + realPath(this.options.projectRoot));
+      const key = hash(inputHash + "\n" + configHash + "\n" + ext);
       const cacheDir = join(this.options.stateDir, "text-projections"), cache = join(cacheDir, key + ".json");
       try {
         const cached = boundedCache(cache);
@@ -121,7 +123,9 @@ export class TextProjections {
       // A read_allow entry may enclose the project. Seatbelt lets a later rule win only for the operation it names, so the
       // deny and the literal grants after it both name file-read-data. The converter runs in its scratch directory (getcwd
       // needs that directory's data), with its program and script arguments resolved to absolute paths.
-      const root = realPath(this.options.cwd), projectDeny = "\n(deny file-read-data (subpath " + sbplString(root) + "))";
+      const root = realPath(this.options.cwd), protectedRoot = realPath(this.options.projectRoot ?? this.options.cwd);
+      if (root !== protectedRoot && !root.startsWith(protectedRoot + "/")) throw new Error("execution root outside protected project");
+      const projectDeny = "\n(deny file-read-data (subpath " + sbplString(protectedRoot) + "))";
       const resolved = programFiles(this.options.cwd, argv);
       // A module loader lists the directories above its script: grant those listings (not their files) up to the root.
       const listings = new Set<string>();

package/src/hub/tooling.ts

@@ -1,7 +1,8 @@
+import { definitionOf } from "../adapters/registry.ts";
 import { spawn, type ChildProcess } from "node:child_process";
-import { accessSync, closeSync, constants, fstatSync, openSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { accessSync, constants, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { delimiter, join, relative, resolve, isAbsolute } from "node:path";
+import { delimiter, relative, resolve, isAbsolute } from "node:path";
 import { realPath } from "./project.ts";
 
 /**
@@ -15,11 +16,6 @@ export const ADDONS = ["claude-mem", "ponytail", "ripwire", "open-code-review",
 export type AddonName = (typeof ADDONS)[number];
 export interface Addon { name: AddonName; version: string | null }
 
-/** Plugin names (before the `@marketplace`) that stand for an add-on. */
-// Maps, not objects: a plugin named `constructor` or `toString` must find nothing, not an inherited property.
-const PLUGINS = new Map<string, AddonName>([["claude-mem", "claude-mem"], ["ponytail", "ponytail"], ["open-code-review", "open-code-review"]]);
-/** Claude Code only: the Codex plugin is a Claude plugin named `codex` from the `openai-codex` marketplace. */
-const CLAUDE_ONLY = new Map<string, AddonName>([["codex@openai-codex", "codex-plugin"]]);
 /**
  * Executables any peer with a shell can run, and how each is told apart from another program of the same name: the
  * first one on PATH is asked for its version (bounded, no stdin), so Graphviz's `dot` is never resource admission.
@@ -32,60 +28,9 @@ const PROBE_MS = 2000, PROBE_BYTES = 4096;
 /** `env` supplies CLAUDE_CONFIG_DIR and CODEX_HOME, the runtimes' own config roots (the hub's environment by default). */
 export interface ToolingSources { home?: string; cwd?: string; path?: string; env?: Record<string, string | undefined> }
 
-/** A regular file of at most 1 MiB, opened without blocking: a FIFO or device under a project's `.claude/` reads as absent. */
-const text = (file: string): string | undefined => {
-  let fd: number | undefined;
-  try {
-    fd = openSync(file, constants.O_RDONLY | constants.O_NONBLOCK);
-    const st = fstatSync(fd);
-    if (!st.isFile() || st.size > 1024 * 1024) return undefined;
-    return readFileSync(fd, "utf8");
-  } catch { return undefined; } finally { if (fd !== undefined) closeSync(fd); }
-};
-const json = (file: string): Record<string, unknown> | undefined => {
-  try { const v = JSON.parse(text(file) ?? ""); return v && typeof v === "object" ? v as Record<string, unknown> : undefined; } catch { return undefined; }
-};
 /** A version string as data, never anything longer or stranger. */
 const version = (v: unknown): string | null => typeof v === "string" && /^[0-9A-Za-z.+_-]{1,40}$/.test(v) ? v : null;
 
-function claudePlugins(root: string, cwd: string | undefined): Addon[] {
-  const enabled = new Map<string, boolean>();
-  for (const file of [join(root, "settings.json"), ...(cwd ? [join(cwd, ".claude", "settings.json"), join(cwd, ".claude", "settings.local.json")] : [])]) {
-    const map = json(file)?.enabledPlugins;
-    if (map && typeof map === "object") for (const [key, on] of Object.entries(map)) enabled.set(key, on === true);
-  }
-  const installed = (json(join(root, "plugins", "installed_plugins.json"))?.plugins ?? {}) as Record<string, { scope?: string; projectPath?: string; version?: unknown }[]>;
-  const out: Addon[] = [];
-  for (const [key, on] of enabled) {
-    if (!on) continue;
-    const name = CLAUDE_ONLY.get(key) ?? PLUGINS.get(key.split("@")[0]!);
-    const entries = Array.isArray(installed[key]) ? installed[key]! : [];
-    // An install for another project is not this one's.
-    const entry = entries.find((e) => e?.scope === "user") ?? entries.find((e) => e?.projectPath === cwd);
-    if (name && entry) out.push({ name, version: version(entry.version) });
-  }
-  return out;
-}
-
-function codexPlugins(root: string): Addon[] {
-  const config = text(join(root, "config.toml"));
-  if (config === undefined) return [];
-  const found = new Map<string, string>(), disabled = new Set<string>(); // plugin name -> marketplace
-  // `[plugins."name@market"]` with no `enabled = false` below it, and plugins whose hooks Codex was told to trust
-  // unless their plugin entry disables them: a trust entry outlives the plugin's own switch.
-  for (const m of config.matchAll(/^\[plugins\."([^"@]+)@([^"]+)"\]\s*\n((?:(?!\[)[^\n]*\n?)*)/gm)) if (!/^\s*enabled\s*=\s*false\b/m.test(m[3] ?? "")) found.set(m[1]!, m[2]!); else disabled.add(m[1]! + "@" + m[2]!);
-  for (const m of config.matchAll(/^\[hooks\.state\."([^"@]+)@([^":]+):/gm)) if (!disabled.has(m[1]! + "@" + m[2]!)) found.set(m[1]!, m[2]!);
-  const out: Addon[] = [];
-  for (const [plugin, market] of found) {
-    const name = PLUGINS.get(plugin);
-    if (!name) continue;
-    let versions: string[] = [];
-    try { versions = readdirSync(join(root, "plugins", "cache", market, plugin)); } catch { /* no cache: version unknown */ }
-    out.push({ name, version: versions.length === 1 ? version(versions[0]) : null });
-  }
-  return out;
-}
-
 /** Never throws: a path that cannot be resolved (a project directory that went away) is compared as given. */
 const real = (path: string): string => { try { return realPath(path); } catch { return resolve(path); } };
 const within = (file: string, dir: string): boolean => { const r = relative(dir, file); return r === "" || (!r.startsWith("..") && !isAbsolute(r)); };
@@ -145,8 +90,7 @@ export async function detectTooling(peer: string, src: ToolingSources = {}): Pro
   const found = new Map<AddonName, Addon>();
   const add = (a: Addon) => { if (!found.has(a.name) || (found.get(a.name)!.version === null && a.version !== null)) found.set(a.name, a); };
   const env = src.env ?? process.env;
-  if (peer === "claude") claudePlugins(env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude"), src.cwd).forEach(add);
-  if (peer === "codex") codexPlugins(env.CODEX_HOME?.trim() || join(home, ".codex")).forEach(add);
+  definitionOf(peer)?.hooks?.pluginInventory?.({ env, home, cwd: src.cwd }).forEach(add);
   const path = src.path ?? process.env.PATH ?? "";
   for (const [bin, spec] of Object.entries(BINARIES)) {
     const file = onPath(bin, path, src.cwd ?? process.cwd());

package/src/hub/ui.ts

@@ -5,6 +5,7 @@ import { PEER_PALETTE, peerPaletteCss } from "../ui/peer-palette.ts";
 import { PEER_START_RETRY_MS } from "./start-mode.ts";
 import { taskProgress } from "../ui/task-progress.ts";
 import { officeModel } from "../ui/office-model.ts";
+import { OFFICE_PEER_ORDER, ADAPTER_DISPLAY } from "../adapters/registry.ts";
 import { needs } from "../ui/needs.ts";
 import { createHash, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -35,10 +36,11 @@ export function startDashboard(options: DashboardOptions) {
   // Inject the same pure public-board model used by the console before computing CSP hashes.
   const html = readFileSync(new URL("../ui/index.html", import.meta.url), "utf8")
     .replace("/* BOARD_MODEL */", () => `const boardColumns = ${boardColumns.toString()}; const peerPalette = ${JSON.stringify(PEER_PALETTE)};`)
+    .replace("/* ADAPTER_DISPLAY */", () => `const adapterDisplay = ${JSON.stringify(ADAPTER_DISPLAY)};`)
     .replace("/* PEER_PALETTE_CSS */", () => peerPaletteCss())
     .replace("/* TASK_PROGRESS_MODEL */", () => `const taskProgress = ${taskProgress.toString()};`)
     .replace("/* PEER_START_RETRY_MS */", () => `const PEER_START_RETRY_MS = ${PEER_START_RETRY_MS};`)
-    .replace("/* OFFICE_MODEL */", () => `const officeModel = ${officeModel.toString()};`)
+    .replace("/* OFFICE_MODEL */", () => `const officeModel = ((OFFICE_PEER_ORDER) => ${officeModel.toString()})(${JSON.stringify(OFFICE_PEER_ORDER)});`)
     .replace("/* NEEDS_MODEL */", () => `const needs = ${needs.toString()};`);
   const hashes = (tag: string) => [...html.matchAll(new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`, "g"))]
     .map((m) => `'sha256-${createHash("sha256").update(m[1]!).digest("base64")}'`).join(" ");