@starci/eslint-grammar-offset-pop 0.12.13 → 0.13.0

package/runtime/modules/models/runtimes.yaml

@@ -0,0 +1,556 @@
+schema: starci/runtimes@1
+purpose: |-
+  Every runtime is a provider-window pool with real parallel slots and a cooldown: the pool boundary IS the
+  quota-window boundary, so one pool never spans two independently metered windows and one window never splits
+  into two pools. Which model takes which work is modules/models/tiers.yaml; the pools themselves live in
+  modules/models/registry.yaml `pools`. This file keeps the operational allocation policy and runtime tuning that is
+  not model data. A runtime that fails is classified and parked for the cooldown of that failure kind, doubling per
+  repeat and capped (cooldownMs, circuitBackoff, maxCooldownMs: every park is time-bounded and expires by itself).
+  Auth health is provider-wide rather than pool-wide: a confirmed launch, worker-start or attestation auth rejection
+  parks every runtime sharing that provider credential. A stale provider token is not admitted (the owner
+  re-authenticates in Orca); a typed no-effect rejection falls through on the same logical operation attempt, while
+  partial or unknown effects require reconciliation before fallback.
+# `maxParallelOps` is the worker-wide ceiling across every workflow; `budgets.maxOps` in the owner's
+# config.yaml is the per-workflow one. The lower of the two admits: engine/admission.mjs
+# opSlotCeiling takes min(budgets.maxOps, maxParallelOps) and scripts/kernel/cli.mjs refuses
+# route/dispatch with `max-ops` at it.
+maxParallelOps: 20
+allocation:
+  # Common new-admission thresholds, consumed by the pure selector and runtime reservation adapter.
+  admission:
+    schema: starci/agent-admission-policy@1
+    version: 1
+    # Age limit of evidence the runtime observes itself at admission time: owner grants and direct probes (Devin).
+    maxAgeMs: 300000
+    # Age limit of provider windows the host polls (Orca account entries). Orca refreshes usage while its window is
+    # focused and after agent sessions end; the runtime cannot request a refresh. A launch against an exhausted window
+    # is refused by the provider and classified by the provider circuit. Never below maxAgeMs.
+    hostPolledMaxAgeMs: 86400000
+    qualityOrder: [economy, standard, frontier]
+    ownerBiasRoles: [op, kernel, supervisor, worker, critic]
+    eligibilityModes: [qualified, probation, kernel-function, scoped-control-plane, operation-policy]
+    roles:
+      kernel: {qualityFloor: standard}
+      op: {qualityFloor: economy}
+      supervisor: {qualityFloor: standard}
+      worker: {qualityFloor: standard}
+      critic: {qualityFloor: standard, independence: provider}
+  # Heavy work fans out: a big node is cut into children with disjoint write scopes, the seam every other child
+  # would touch is built first and alone, then the rest run at once - bounded here so one parent never takes
+  # every slot of the pool and leaves the rest of the tree waiting behind it.
+  fanOut: {seamFirst: true, maxPerGroup: 10}
+  # Deterministic same-op slicing — the kernel measures the write scope and calls `starci kernel estimate`;
+  # it never guesses an agent count. W = sum(weight * count) in agent-minutes places the closure in
+  # a `size` class, and the class plus the owner's `parallel.gear` (config.yaml) names how many
+  # agents the op asks for. `s` and `m` are always one agent; only `l` and `xl` fan out. The static
+  # bounds in kinds.yaml (12 files / 8 assertions / 3 components) are a coarse screen over the same
+  # measure — the estimate is the authority. When N > 1 slices are admitted together the kernel
+  # routes them one after the other with plain starci kernel route (a Kernel --prefer/--avoid is ignored, owner
+  # decision 2026-09-25) so the workers spread over the lanes instead of piling onto the first pool. Each
+  # routed slice is recorded as a pick before the next one is routed, so the balance step spreads the slices.
+  # A gear never raises a pool's maxParallel, maxParallelOps or budgets.maxOps: it raises only what
+  # `starci kernel estimate` requests, and admission still clamps it.
+  slicing:
+    weights: {file: 4, assertion: 3, component: 12, record: 2}
+    targetMinutes: [15, 30]
+    maxSlices: 15
+    gears: [1, 2]
+    # Size classes over the same measure. A closure is `xl` when any of its counts reaches an `xl`
+    # bound, `l` when any reaches an `l` bound, `s` when W is inside targetMinutes[0], else `m`.
+    # `l.from.files: 12` is ledger-derived: of 52 settled implement/refactor/author jobs in the
+    # measured product ledger, closures at or above 12 authored files ran a median 46 min against 12 min below
+    # it, the first cutoff where the majority exceeds one targetMinutes[1] window
+    #. Every other `from` bound is a sketch value carried as an ASSUMPTION: that ledger holds exactly one job over three
+    # windows and no assertion or component measurement at all, so `xl.from` and both `assertions`
+    # bounds have no observation behind them and are re-derived when estimate inputs are recorded.
+    size:
+      l:  {from: {files: 12, assertions: 40},  agents: {1: 3, 2: 5}}
+      xl: {from: {files: 40, assertions: 150}, agents: {1: 6, 2: 10}}
+  # The workers' operating windows, in milliseconds. engine/config.mjs allocationMs() is how code reads
+  # them and kernel contracts cite the key rather than restating the number, so each one is changed here
+  # and nowhere else.
+  dispatchLeaseTtlMs: 1800000
+  watchdogCadenceMs: 300000
+  # usageEveryMs: the token meter's sweep interval (host controller duty host/usage, scripts/kernel/usage-record.mjs). An attempt that ended less
+  # than this ago is still being metered: the autopilot budget does not count its missing usage as unknown (scripts/kernel/autopilot-budget.mjs).
+  usageEveryMs: 300000
+  observeCadenceMs: 180000
+  # activeStaleMs: an `active` screen (spinner/"Working" row) is trusted only while the terminal still
+  # prints; a spinner re-renders every second, so output older than this is a frozen frame. The watchdog
+  # then treats the Kernel as turn-idle (reason stale-active) and wakes it, and a worker reads turn-idle
+  # for the nudge frontier (scripts/lib/terminal-liveness.mjs staleAwareState).
+  # quietMs: a worker still at its idle prompt (or frozen) this long after a delivered nudge, with no
+  # output since, is quiet - dead to the frontier; the watchdog settles it failed-no-report and queues
+  # its retry (starci kernel reconcile --dead-worker --settle-failed). A provider card's liveness.activeStaleMs /
+  # liveness.quietMs overrides these per provider (modules/models/agents/<provider>.yaml).
+  # launchGraceMs: a managed worker-start returns before Orca injects the worker's Task, so for this
+  # long after its op-dispatched event a managed worker that still reads an idle prompt is `starting`
+  # - never nudge-ready, and starci kernel nudge skips it worker-starting.
+  # A command-terminal dispatch has already proven its prompt submitted and carries no grace; a
+  # staged paste is nudge-ready at any age, and a nudge since the dispatch ends the grace.
+  # kernelTurnBudgetMs / supervisorTurnBudgetMs: the longest ONE busy turn of a Kernel / the [Supervisor] seat (its
+  # spinner timer) before the reconciler's host controller sends the agent's own interrupt key and re-wakes it with
+  # the decision doorbell; still the same turn turnInterruptGraceMs later, the seat is replaced (KERNEL_TURN_OVERDUE,
+  # scripts/reconciler/controllers/host.mjs turnStep). A busy turn defers every doorbell and notice (kernel-busy).
+  liveness: {activeUnclassifiedMs: 120000, activeStaleMs: 600000, quietMs: 1200000, launchGraceMs: 90000,
+    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000,
+    # The watchdog's replacement of a Kernel seat runs start-workflow (worktree check, install, Orca launch, attestation): bounded here, under the Host controller's
+    # seats.kernel.timeoutMs that kills the whole watchdog pass. A start that outlives it is killed and recorded kernel-start-failed (start-timeout), never lost silently.
+    kernelStartTimeoutMs: 600000}
+  # one local git read over a job's owned paths (scripts/kernel/owned-path-effects.mjs ownedPathEffects, job-artifacts.mjs).
+  settleGit: {commandMs: 15000}
+  # prompt-file.mjs owns terminal delivery, wake bounds, file placement and cleanup.
+  promptFile: {maxChars: 2000, ttlMs: 86400000}
+  # opVerbs: the bound of the "your verbs" block of an [Op] prompt (scripts/kernel/op-prompt-verbs.mjs): the starci calls the op's contract names,
+  # each with the flags the contract uses and the required ones, one line per verb. A worker that has the exact call never runs --help
+  # (a measured op spent 15 of its 135 turns on it). `standing` verbs are printed in full by the prompt's own reporting and logging blocks;
+  # `omitGroups` are the verbs of the Kernel and above, which an op's contract names only to say who runs them.
+  opVerbs: {maxVerbs: 20, maxChars: 3000, lineChars: 190, standing: ["kernel report", "kernel log", "kernel op-contract"],
+    omitGroups: [kernel, supervisor, workflow, reconciler]}
+  # Typed logs (scripts/kernel/typed-logs.mjs, the ledger's logs table): perJobCap rows a job's own writes
+  # may store before one log.truncated row closes them (derived event rows are never capped); dataMaxBytes bounds
+  # one row's data after redaction. diff: the caps of a job patch's pre-structured <patch>.json
+  # (scripts/kernel/patch-json.mjs) - lines kept per file and in total, files, characters per line, and the size of
+  # an image literal decoded into <patch>.assets/.
+  logs:
+    perJobCap: 2000
+    dataMaxBytes: 4096
+    diff: {fileLines: 1500, totalLines: 20000, files: 400, lineChars: 2000, assetBytes: 5242880}
+  # Recovery windows. hostOutage (scripts/kernel/host-outage.mjs): how long a watchdog tick or a kernel
+  # start waits for an Orca that does not answer, and how long after a responding Orca calls a kernel dead
+  # it is asked again.
+  hostOutage: {waitMs: 90000, deathSettleMs: 10000}
+  # supervisorTick: the numbers the reconciler controllers read
+  # (host thresholds, orca probes, statusApp port, owner digest cadence). host: above maxNode node.exe or maxGit git.exe processes the host
+  # controller logs the counts and the parents holding the most. orca: terminal-list is probed up to probes times, probeTimeoutMs each, gapMs apart; when every
+  # probe fails the Orca app (never its terminal daemon) gets closeWaitMs to close before it is forced, is launched
+  # again, and restart-all runs. deadKernelMs: a watchdog whose trailing ticks read tick-failed or restart-failed
+  # this long flags a dead kernel. orphanedFrontierMs: a workflow read orphaned-frontier on ticks this far apart is
+  # flagged. noProgressMs: a STALLED workflow idle this long is flagged. statusApp: the status
+  # UI's ports and scheduled task — port serves the built UI and its read-only API, devPort the Vite dev/preview
+  # server (ui/ports.mjs is the one reader; nothing else states either) — restarted when port does not answer
+  # within probeTimeoutMs. alertRepeatMs: one
+  # alert key reaches the inbox and Telegram at most once per window. actionSlaMs: an owed action (scripts/supervisor/
+  # actions.mjs) no supervisor action touched this long is an SLA breach, alerted into the Supervisor's inbox.
+  # ownerDigestMs: the Owner Notifier's periodic owner digest goes out at most this often.
+  supervisorTick:
+    host: {maxNode: 300, maxGit: 100}
+    orca: {probeTimeoutMs: 30000, probes: 5, gapMs: 30000, closeWaitMs: 20000}
+    deadKernelMs: 900000
+    orphanedFrontierMs: 1800000
+    noProgressMs: 21600000
+    statusApp: {port: 4547, devPort: 4545, task: 'StarCi Harness App', probeTimeoutMs: 5000}
+    alertRepeatMs: 21600000
+    actionSlaMs: 1800000
+    ownerDigestMs: 7200000
+  # supervisorLearning (scripts/machine/lessons.mjs, supervise.yaml selfLearning): a failure signature seen
+  # minRepeats times opens a hypothesis; a landed experiment is measured for measureMs (its signature recurring, a new
+  # signature naming a file it changed, or an op success rate lower by successDrop -> revert due); at most
+  # dailyAutoLandCap autonomous landings in 24 h; an owner-feedback lesson weighs ownerWeight (a self-derived one 1).
+  supervisorLearning: {minRepeats: 2, measureMs: 21600000, dailyAutoLandCap: 8, ownerWeight: 3, successDrop: 0.1}
+  # progress (scripts/kernel/progress-rca.mjs; owner 2026-09-28 "could the supervisor not think before?" and "why do
+  # workflows not coordinate themselves but wait for the supervisor"): the outcome SLA each Kernel reads first on every wake (starci kernel status
+  # progress + rca) and the Supervisor backstops. units/h over windowMs (only units that passed their gates), ETA over
+  # etaWindowMs. A priority workflow (highest ramThrottle.priorities weight) below minUnitsPerHour.priority for graceMs,
+  # or holding queued-ready work while running < its allowed parallelism, is a progress stall: the Kernel acts on the
+  # ranked rca.actions at once; a stall older than supervisorGraceMs is the Supervisor's (progress-stall). maxUnitsPerEdit
+  # bounds one light graph-edit; recutThreshold open cut-shaped failures (absent paths, grants too narrow) rank a heavy
+  # re-cut first. rca: failures of one op in one workflow >= minFailures inside windowMs open the RCA even without a stall.
+  # commandTimeoutMs: the window the tool-timeout action gives an op (op-override).
+  progress:
+    windowMs: 3600000
+    etaWindowMs: 21600000
+    graceMs: 1800000
+    supervisorGraceMs: 3600000
+    minUnitsPerHour: {priority: 3, default: 0}
+    maxUnitsPerEdit: 3
+    recutThreshold: 3
+    commandTimeoutMs: 600000
+    # settleBacklog: SETTLE-FIRST - starci kernel route/dispatch refuse settle-backlog while >= max filed reports older than ageMs
+    # wait unconsumed (a finished [Op] keeps its terminal and slot until its settle closes it).
+    # The runtime settles green reports itself (settler below); this refusal counts only the reports waiting on the Kernel
+    # (non-green outcomes and done reports the settler handed over as needs-kernel-decision), consumed or not.
+    settleBacklog: {max: 3, ageMs: 120000}
+    rca: {minFailures: 3, windowMs: 86400000, examples: 4}
+  # settler (scripts/kernel/settle/job-settle.mjs; owner ruling settle-runtime-service 2026-09-28): the runtime settles every
+  # filed done report whose declared checks re-verify green through the same `starci kernel record-checks` + `starci kernel settle` path, from each
+  # workflow watchdog loop every everyMs and right after `starci kernel report`. rerunTimeoutMs bounds one declared check re-run and
+  # itemBudgetMs one report. invariantMaxAgeMs: the Supervisor tick asserts no filed/consumed report of a live job stays
+  # unsettled and un-handed-over longer than this (settle-unsettled-report, a runtime bug). releaseWindowMs: settled jobs
+  # this recent whose worker close is unproven are closed and verified. tail: the async settle tail (artifact indexing,
+  # evidence copy, session retention, input baselines, rev drift) retries a failed run after retryMs, up to maxAttempts.
+  settler:
+    everyMs: 60000
+    rerunTimeoutMs: 300000
+    itemBudgetMs: 900000
+    invariantMaxAgeMs: 180000
+    releaseWindowMs: 86400000
+    tail: {retryMs: 120000, maxAttempts: 5}
+  # redesign (starci kernel redesign; owner 2026-09-28: heavy redesign is dispatched to the op that owns it, and the Kernel stays on
+  # Devin): these ops, enqueued from an RCA, route as `routeAs` (implementation.plan) at
+  # >= minDifficulty at `effort`.
+  redesign:
+    ops: [work.author, scope.define, goal.revise]
+    routeAs: implementation.plan
+    minDifficulty: hard
+    effort: high
+  # selfReload (scripts/machine/self-reload.mjs): a watchdog loop re-execs at most once per minIntervalMs; its
+  # replacement takes over the loop's lock within handoverMs or is stopped. The reconciler engine checks every checkMs; an engine whose
+  # revision still differs from the live one that long past minIntervalMs + checkMs + handoverMs is a drift row (scripts/reconciler/drift.mjs).
+  selfReload: {minIntervalMs: 300000, handoverMs: 30000, checkMs: 60000, driftGraceMs: 120000}
+  # deploy (scripts/reconciler/runtime-deploy.mjs): a deploy waits up to waitMs, polling every pollMs, for the settles, Critic runs and prepared
+  # decisions in flight to finish; after the engine restart it waits up to verifyMs for the new leader's fresh heartbeat on the new revision.
+  deploy: {waitMs: 1800000, pollMs: 5000, verifyMs: 120000}
+  # dispatchRefusal (scripts/kernel/dispatch-refusal-memo.mjs): a ready job whose dispatch is refused for the same cause is tried again after baseMs, then twice as long each time (the one retry budget), up to capMs; a change of
+  # the cause's fingerprint (runtime revision, a ruling, a resource the refusal names) tries it at once.
+  dispatchRefusal: {baseMs: 60000, capMs: 900000}
+  # footprint (scripts/guards/footprint-scan.mjs): one host-wide scan at most every everyMs; a crashed
+  # tick's claim lock is cleared after lockStaleMs.
+  footprint: {everyMs: 600000, lockStaleMs: 60000}
+  # jobGuard (scripts/guards/hook-install.mjs): a guard file older than ttlMs is pruned.
+  jobGuard: {ttlMs: 604800000}
+  # landGate (scripts/supervisor/land.mjs): a land waits waitMs for its turn at the gate.
+  landGate: {waitMs: 1800000}
+  # workerClose (scripts/machine/worker-close.mjs; owner rule: a finished worker is closed COMPLETELY): after worker-release and the terminal
+  # close the runtime waits verifyMs for every process of that terminal's shell tree to end (polled every pollMs); a survivor proven to belong
+  # to the tree is stopped and given stopVerifyMs to end before the finding is raised.
+  # A finished [Worker] job whose terminal has no recorded closure is closed again by the Job controller's worker sweep (scripts/supervisor/supervisor-watchdog.mjs):
+  # every leftoverRetryMs (doubling to leftoverRetryMaxMs) for at most leftoverRetryAttempts attempts, each failure recorded with its reason on the job.
+  # uatSlot (scripts/uat/slot-collect.mjs, slot-lessee.mjs): a held UAT run checks its lessee (its attempt, the process that launched it) every watchMs and ends with it;
+  # the Host pass ends a slot whose lessee is gone, and a slot that recorded no lessee at all once it has been held unknownHoldMs (3 hours: a UAT run is minutes).
+  uatSlot: {watchMs: 5000, unknownHoldMs: 10800000}
+  workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000, leftoverRetryMs: 60000, leftoverRetryMaxMs: 900000, leftoverRetryAttempts: 12}
+  # providerReservation (scripts/machine/provider-reservation-reap.mjs): an admission whose receipt stayed `reserved` this long never reached
+  # worker-start (the consume moves it to `launching` first), so its launcher died and the slot is released. A receipt with no terminal handle and no
+  # process is released once the host restarted after its last update (scripts/machine/provider-reservation-restart.mjs); restartToleranceMs is the
+  # margin the restart instant must clear that update by. A handle-less receipt no proof reaches opens the PROVIDER_RESERVATION_HELD clock after unknownHeldMs.
+  providerReservation: {reservedStaleMs: 900000, unknownHeldMs: 1800000, restartToleranceMs: 5000}
+  # hostLock (scripts/machine/verb-lock.mjs): a verb that finds the host lock held (npm ci, npm install) retries on the retry budget
+  # of scripts/lib/retry-budget.mjs (the interval doubles to retryMaxIntervalMs) until retryDeadlineMs, then refuses with every attempt named.
+  hostLock: {retryIntervalMs: 5000, retryMaxIntervalMs: 30000, retryDeadlineMs: 180000}
+  # waiterPriority (scripts/kernel/waiter-priority.mjs): a queued job that has blocked another
+  # workflow this long earns its Kernel one heads-up per newly waiting workflow.
+  waiterPriority: {blockingHeadsUpMs: 900000}
+  # cutSeam (scripts/kernel/seam-policy.mjs; owner ruling 2026-09-28 "a seam must not block the whole chain"): a cut
+  # sibling ordinal waits on its seam at most maxSiblingWaitMs (30 min), then runs on a stub and owes one
+  # cut-seam-reconcile once the seam lands; a published seam interface, a seam whose latest attempt
+  # settled failed/blocked, or recutAfterFailures failed seam attempts release it at once (and owe a re-cut).
+  cutSeam: {maxSiblingWaitMs: 1800000, recutAfterFailures: 2}
+  # opTelemetry (scripts/machine/op-metrics.mjs): op health per op and per workflow over the last windowMs; the
+  # supervisor tick records one supervisor-op-metrics snapshot per run and the owner digest's trend line compares the
+  # newest with the one closest to trendMs earlier. stuckSla: every wait a running workflow holds (starci kernel status stuck[])
+  # is severity warn past warnMs and critical past criticalMs - either is a Supervisor owed action; the tick alerts
+  # every critical one.
+  opTelemetry:
+    windowMs: 86400000
+    trendMs: 86400000
+    stuckSla:
+      owner-gate: {warnMs: 14400000, criticalMs: 86400000}
+      peer-wait: {warnMs: 3600000, criticalMs: 14400000}
+      dependency: {warnMs: 14400000, criticalMs: 86400000}
+      retry-cap: {warnMs: 1800000, criticalMs: 14400000}
+      deferred-settle: {warnMs: 1800000, criticalMs: 7200000}
+      queued-ready: {warnMs: 900000, criticalMs: 3600000}
+      throttled: {warnMs: 3600000, criticalMs: 14400000}
+  # quitAgent (scripts/kernel/quit-agent.mjs): after the agent's own quit input is typed, settle waits
+  # this long for the terminal to disconnect before the release/close proceeds anyway.
+  quitAgent: {waitMs: 6000}
+  # drawRender (scripts/work/draw-render.mjs): a capture waits settleMs after document.fonts.ready.
+  drawRender: {settleMs: 500}
+  # layoutRender (scripts/work/layout-render.mjs): the runtime serves the product app for one capture; readyMs is how long the dev server may take to answer
+  # its first request (a cold Next compile), navigateMs the page load, settleMs the wait after fonts are ready, stopMs the grace before a still-running server is killed.
+  # publicOriginKeys are the scaffold's public-origin variables (its README: the product app's own address and the product app the landing hands over to); each gets the render's origin.
+  layoutRender: {readyMs: 180000, navigateMs: 90000, settleMs: 500, stopMs: 5000, publicOriginKeys: [NEXT_PUBLIC_SITE_URL, NEXT_PUBLIC_APP_URL]}
+  # drawLoop (scripts/work/draw-loop.mjs, scripts/work/draw/draw-taste.mjs; owner rulings 2026-09-27): interface.draw
+  # draws -> shoots -> evaluates -> fixes in rounds. A loop stops when every machine metric passes and the
+  # independent critic's beauty is at least beautyMin, after maxRounds, or after stallRounds rounds in a row that
+  # neither cut the failures nor raised the beauty; the best round is kept. Taste thresholds: accentBudget is the
+  # largest share of the render the accent colour may fill (the brand art band excluded), bandsPerCardMax the most
+  # hairline bands one card splits into, badgesPerEntityMax the most badges one entity carries. critic is the fresh,
+  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: picked through
+  # the tier picker from the Critic tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with the
+  # independence rule as a hard filter, then started
+  # through orchestration worker-start --agent <provider> --model --effort (scripts/agent/lib.mjs startAgent) on a
+  # runtime worktree detached at the empty tree (draw-critic.mjs criticWorkspace; Orca refuses a bare temp dir) holding only the PNGs, the HTML and the rubric; it writes verdict.json and reports worker_done; a
+  # critic with no worker_done within criticTimeoutMs is stopped and released (outcome timeout, no beauty). The critic is a member of ANOTHER PROVIDER than
+  # the drawer: the members of its tier of that provider are removed before the pick, and a tier with no other provider's member refuses the critique with
+  # CRITIC_NO_INDEPENDENT_MEMBER (the drawer never judges itself). The images a drawer asks of the imagegen call
+  # (starci work imagegen) do not make the call's model the drawer. The drawer is the op's provider, bound to its
+  # terminal (scripts/guards/op-context.mjs) or named by draw-loop.mjs round --drawer; a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
+  # archetype for its ui record's ui.archetype - brand.mjs checkDirection evidence.ready, the owner's receipt
+  # (scripts/kernel/prerequisites.mjs direction-unaccepted; the Kernel enqueues brand.decide --param
+  # directionArchetype=<archetype> first). false switches the gate off.
+  drawLoop:
+    maxRounds: 10
+    stallRounds: 2
+    beautyMin: 8
+    accentBudget: 0.10
+    bandsPerCardMax: 3
+    badgesPerEntityMax: 2
+    criticTimeoutMs: 900000
+    directionPrerequisite: true
+    # How long the workflow that claimed foundation `shell` (the layout chain an interface.draw draws) may hold it before a
+    # waiting draw opens a Supervisor Decision Item (scripts/kernel/shell-foundation.mjs; owner ruling 2026-09-29 draw-from-todo).
+    shellFoundationStallMs: 7200000
+  # autopilot (scripts/kernel/autopilot-run.mjs; owner ruling 2026-09-28 autopilot-run-to-finish, modules/kernel/
+  # owner-rulings.yaml): "run to the finish in one go, don't stop to ask the owner - not even UX/UI review; the owner
+  # reviews once at the end". enabled is the default for every running workflow; workflows.<workflowId>.enabled
+  # overrides it for one workflow (starci kernel autopilot --workflow <id> --set on|off records a ledger override that wins
+  # over both). Under autopilot:
+  #   - a draw-review or brand-direction-review ask whose machine gates pass is answered PROVISIONALLY (answeredBy
+  #     autopilot, receipt provisional:true + gate evidence); it never becomes golden and never counts as an owner
+  #     answer (owner-claim.mjs). Failing gates answer redraw/revise with the gate findings, at most
+  #     redrawBudget times per record, then the leg is deferred to the final review;
+  #   - a credential, real-money, shared-external-system or owner-only ask is deferred-to-handover: nothing is
+  #     sent or waited on, the leg proceeds on the sandbox/stub path the deferral names, the live-proof legs that
+  #     need it wait for the one end-of-flow credential checklist (provision.ask subject handover-credentials);
+  #   - a retry cap or an owner-gate that is really a runtime/process issue is a supervisor-gate incident (the
+  #     Supervisor fixes or decides the retry), supervisorExtraBudget gates per node group, then the leg is
+  #     deferred; an unresolved supervisor-gate older than supervisorGateTimeoutMs defers what it holds once the owner was told
+  #     (its Supervisor item reached the owner level: modules/kernel/op-incident-policy.yaml gate.deferAfter);
+  #   - budgets caps one workflow (non-kernel jobs, token total recorded on jobs, wall time since start): past
+  #     one, a supervisor-gate holds new dispatch until the Supervisor extends the budget.
+  autopilot:
+    enabled: true
+    workflows: {}
+    redrawBudget: 2
+    supervisorExtraBudget: 2
+    supervisorGateTimeoutMs: 21600000
+    budgets: {attempts: 600, tokens: 400000000, wallMs: 1209600000}
+  # serveAsk (scripts/kernel/ask-server.mjs): the default lifetime of a served owner-ask link
+  # (--ttl <ms> overrides it per serve).
+  serveAsk: {ttlMs: 14400000}
+  # workerJobs (scripts/supervisor/workers.mjs takeLeases, scripts/supervisor/supervisor-watchdog.mjs
+  # filedReports): a contract worker's file leases expire leaseTtlMs after it takes them, so a dead
+  # worker's leases free themselves; the watchdog consumes worker reports filed in the last
+  # reportWindowMs.
+  workerJobs: {leaseTtlMs: 604800000, reportWindowMs: 604800000}
+  # draft (scripts/kernel/clear-draft.mjs): the beat between one Ctrl+U and the re-read that judges
+  # the input box's answer - a TUI repaints a beat later. clearDraft defaults to it and
+  # wake-delivery caps its runtime-owned draft clear interval at it.
+  draft: {intervalMs: 300}
+  # housekeeping (scripts/housekeeping/housekeeping.mjs): every retention window and root the host
+  # cleanup reads - no literal may live in the script. tmp: top-level %TEMP% entries whose name starts
+  # with one of tmpPrefixes (the prefixes StarCi, its ops lanes and its spec fixtures create) and
+  # whose age passes tmpMaxAgeMs are removed, never %TEMP%/claude and never a dir a live process
+  # holds. Agent session files (codex sessions and archived_sessions, devin
+  # transcripts and summaries, orca's own codex-runtime-home sessions/generated_images) older than
+  # sessionArchiveAfterMs move under archiveRoot keeping their relative path; Claude Code project
+  # transcripts get the longer claudeTranscriptArchiveAfterMs. Archive files older than
+  # archiveMaxAgeMs are deleted outright. lanesRoot is where lane worktrees sit; a landed lane is
+  # removed only once its branch reflog, HEAD reflog and directory stayed unchanged for laneGraceMs
+  # (a fresh lane with no commit yet reads as landed to git cherry); unset, no lane is removed.
+  # logMaxAgeMs caps every jsonl and log under the state base (<runtime root>/.runtime) and ~/.starci.
+  # gitIndexLockStaleMs: a product checkout's .git/index.lock older than this, with no git process on
+  # that repository (one naming no repository counts as on it), is removed by
+  # scripts/api/git/index-lock.mjs - from the op worker's git shim before git runs, and by the
+  # housekeeping area gitlocks - and recorded as a supervisor-ledger git-index-lock-removed event. A
+  # live git holds the lock only while it writes (a commit with hooks: minutes at most), and its
+  # process keeps the lock regardless of age.
+  housekeeping:
+    tmpMaxAgeMs: 172800000
+    tmpPrefixes: [coverage-generated-wire-, work-validate-lite-, example-refs-lite-, example-lite-, coverage-inventory-, policy-, rights-, l4-, starci, starci-w2, evidence, sup-k, work-v3, scoped-lint, si-, w1-, nivo-, orca-spec,
+      owner-bias-cli-, admission-runtime-, agent-launch-, starci-provider-budget-, starci-provider-schema-,
+      codex-, deps-, direction-part-, draw-layer-, footprint-, grammar-pin-, guard-, literal-argv-, module-yaml-,
+      doc-language-, guidance-, hk-, hfs-, install-link-, kernel-check-, kguard-, sup-orca, land-, op-manifest-, path-key-, pathspec-, push-scan-spec-, rename-over-, sbl-, serve-ask-, sup-chat, sup-repo, sup-src, sup-wd,
+      work-acceptance-, work-brand-test-, work-core-test-, work-custody-test-, work-external-,
+      work-index-md-, work-module-spec-, example-critique-, example-derive-, example-evidence-, example-verify-,
+      example-work-gate-, work-artifacts-, work-consistency-, work-surfaces-,
+      grammar-land-, kernel-replace-close-, nm-link-, rc-job-, rc-health-, release-gate-, seat-titles-, slice-typecheck-, unit-roles-, spec-budget-,
+      model-hotload-, price-hotload-, owner-trust-, fs-kind-contract-, private-publication-, private-create-, private-lease-, private-partial-,
+      private-unknown-, private-inode-, private-bound-, private-link-, private-prefix-, check-entry-, core-tree-, runtime-public-docs-, blob-publication-,
+      core-debug-schema-, ledger-native-case-, sbx-spec-, runtime-artifact-, gc-archive-proof-, machine-retention-, zip-resource-,
+      core-seat-, core-diag-]
+    sessionArchiveAfterMs: 259200000
+    claudeTranscriptArchiveAfterMs: 604800000
+    archiveMaxAgeMs: 2592000000
+    # archiveRoot and lanesRoot are unset on purpose: no host location lives in a tracked file. The defaults are
+    # <starciLocalRoot>/archive (<runtime root>/.runtime/archive) and a per-user lanes directory outside the checkout (scripts/machine/home.mjs archiveRoot, lanesRoot); the owner
+    # relocates them with STARCI_ARCHIVE_ROOT and STARCI_LANES_ROOT or by setting these keys on the host.
+    laneGraceMs: 86400000
+    logMaxAgeMs: 1209600000
+    gitIndexLockStaleMs: 300000
+    # gc: the Supervisor's garbage collection (scripts/supervisor/gc.mjs, every tick; owner 2026-09-28 "there must be
+    # garbage collection"). An idle bare shell or an unregistered runtime terminal of a live workflow is closed only once it has
+    # been seen for gcMinAgeMs (a dispatch binds its terminal well within that); a merged lane worktree only once idle
+    # for gcLaneGraceMs. GC never purges an ended workflow: housekeeping does (Q6: 30 days, zipped and verified first).
+    gcMinAgeMs: 600000
+    gcLaneGraceMs: 1800000
+  # gc: the cadence of the Supervisor's periodic sweep (scripts/supervisor/gc.mjs; owner 2026-09-28 "every 30 minutes, not
+  # every tick": the tick only checks whether it is due) and the tabs it never touches (keepTitles: regexes on the tab or
+  # pane title; an owner's hand-opened tab with recent output is reported, not closed, allowlisted or not).
+  gc:
+    sweepMs: 1800000
+    # laneCap: the most lane worktrees that stay registered under the lanes root (scripts/supervisor/gc.mjs collectLanes); past it the
+    # longest idle clean lanes go, landed or not (an unlanded lane keeps its branch). Owner rule: worktrees never accumulate.
+    laneCap: 40
+    keepTitles: []
+  # reconciler (scripts/reconciler/*; DESIGN 7.4-7.8, contract modules/reconciler/reconciler.yaml): the engine polls
+  # every ledger's events every pollMs; the leader row lasts leaseMs and is renewed (with the heartbeat row and file)
+  # every renewMs; boot.mjs ensure restarts an engine whose heartbeat is older than
+  # heartbeatStaleMs; one starci kernel status snapshot per workflow is shared for statusCacheMs; a failing key backs off
+  # backoff.minMs doubling to backoff.maxMs; more than crashLoop.max engine starts in crashLoop.windowMs start it
+  # --safe (read-only) and push the owner one urgent Telegram (boot.mjs).
+  reconciler: {pollMs: 2000, leaseMs: 30000, renewMs: 10000, heartbeatStaleMs: 60000, statusCacheMs: 20000, backoff: {minMs: 1000, maxMs: 300000, maxAttempts: 24}, crashLoop: {max: 3, windowMs: 1800000}, modeDriftMs: 60000}
+  # resources: the host-floor guards the provider-health / admission path reads. These are the shipped defaults; the owner's
+  # config.yaml `resources` (minFreeDiskGb, minFreeDiskPct, minFreeRamPct) overrides them key by key and code holds no number of its own.
+  # Below the disk floor (minFreeDiskGb, or minFreeDiskPct of the drive's size when the owner sets it - the larger applies)
+  # `starci kernel dispatch --spawn` refuses host-resources-low until there is room again - measured on the
+  # drives that hold the configured temp root (config.yaml roots.temp, else the OS temp directory) and the repos. RAM goes through the RAM-aware, priority-aware throttle
+  # (scripts/machine/ram-throttle.mjs; owner ruling 2026-09-28 "Parallelism ceiling follows real RAM: free RAM below 15%
+  # then reduce the number of parallel ops, avoid freezing the machine and killing ops mid-run"): at every dispatch the effective cap
+  # is min(maxParallelOps, running + the ops that fit in free RAM above hardFloorPct of total), counted across
+  # every ledger of the host, and never above maxParallelOps. minFreeRamPct is the heavy floor: below it no NEW
+  # heavy op (opRam class heavy: Playwright / render / test / implement) starts from a workflow below the top
+  # priority, light ops still start; heavy resumes only above ramThrottle.heavyResumeAbovePct (hysteresis).
+  # Below landSpecPauseBelowPct no heavy op starts from any workflow and the land gate's spec runs pause until
+  # free RAM is back above landSpecResumeAbovePct. A CPU at or above cpuHeavyStopAbove pauses heavy ops the
+  # same way until it falls below cpuHeavyResumeBelow. Running ops are never stopped. Owner ruling 2026-09-28
+  # ("15→10, 10→2.5"): the heavy floor 10% resuming at 15%, critical 2.5% resuming at 5%, the fit floor 2.5%.
+  resources:
+    minFreeDiskGb: 5
+    minFreeRamPct: 10
+    ramThrottle:
+      heavyResumeAbovePct: 15
+      landSpecPauseBelowPct: 2.5
+      landSpecResumeAbovePct: 5
+      hardFloorPct: 2.5
+      cpuHeavyStopAbove: 0.95
+      cpuHeavyResumeBelow: 0.85
+      # The estimate history: the newest historySamples op-ram-footprint samples (the Resource controller records them);
+      # a kind's measured RAM replaces its opRam prior once it has historyMinObservations observations. kernelMb:
+      # the RAM one running Kernel's agent is assumed to hold, subtracted from the agent trees before sharing.
+      historySamples: 48
+      historyMinObservations: 3
+      kernelMb: 900
+      # priorities: {<workflowId>: {weight, reserve}}. Weight 1 is everyone's default. A workflow below the top
+      # weight leaves `reserve` slots (and the RAM its queued ops need) to the higher ones and loses its heavy
+      # ops first under the heavy pause; the top one keeps starting heavy ops while they fit, until critical.
+      # The Supervisor overrides per host: starci supervisor ram-cap prioritize --workflow <id>
+      # --weight <n> [--reserve <slots>]. Owner priority 2026-09-28: the prioritized FE refactor workflow ran
+      # up to 15 parallel code.refactor slices first; the other workflows ramped up in what was left.
+      priorities: {}
+    # opRam: the per-op RAM estimate table (MB for one running op: the agent CLI plus what it runs - the
+    # test runner, the browser, the dev server) and its class. heavy = Playwright / render / test /
+    # implement; light = reading, deciding, writing records. A kind not listed takes `default`.
+    opRam:
+      default: {mb: 1000, class: light}
+      backend.implement: {mb: 2500, class: heavy}
+      interface.implement: {mb: 3000, class: heavy}
+      interface.draw: {mb: 3500, class: heavy}
+      interface.asset: {mb: 2500, class: heavy}
+      interface.audit: {mb: 3000, class: heavy}
+      brand.decide: {mb: 3000, class: heavy}
+      code.refactor: {mb: 2000, class: heavy}
+      code.fix: {mb: 2000, class: heavy}
+      test.author: {mb: 2500, class: heavy}
+      task.execute: {mb: 2000, class: heavy}
+      backend.scaffold: {mb: 2000, class: heavy}
+      interface.scaffold: {mb: 2000, class: heavy}
+      package.scaffold: {mb: 2000, class: heavy}
+      uat.verify: {mb: 3500, class: heavy}
+      uat.assisted.verify: {mb: 3500, class: heavy}
+      e2e.verify: {mb: 3500, class: heavy}
+      perf.verify: {mb: 3500, class: heavy}
+      unit.verify: {mb: 2500, class: heavy}
+      integration.verify: {mb: 2500, class: heavy}
+      security.verify: {mb: 1500, class: light}
+      review.verify: {mb: 1000, class: light}
+      runtime.operate: {mb: 1500, class: light}
+      release.deliver: {mb: 1500, class: light}
+      architecture.decide: {mb: 800, class: light}
+      business.decide: {mb: 800, class: light}
+      decision.prepare: {mb: 800, class: light}
+      request.analyze: {mb: 800, class: light}
+      scope.define: {mb: 800, class: light}
+      scope.finish: {mb: 800, class: light}
+      goal.revise: {mb: 800, class: light}
+      docs.author: {mb: 800, class: light}
+      content.generate: {mb: 800, class: light}
+      work.author: {mb: 800, class: light}
+      grammar.update: {mb: 800, class: light}
+      knowledge.repair: {mb: 800, class: light}
+      handover.review: {mb: 800, class: light}
+      provision.ask: {mb: 800, class: light}
+      uat.assisted.prepare: {mb: 1000, class: light}
+      workspace.manage: {mb: 1000, class: light}
+  # A routed-but-queued job (payload.model set, status queued) holds its pool slot only this long after its latest route
+  # decision (payload.routedAt, else its newest route-decided event): long enough for one fan-out's sequential route
+  # calls to spread across pools, short enough that a job parked behind a gate, hold, peer-wait, dependency or
+  # readiness loop does not starve the pool (scripts/kernel/cli.mjs poolLoadOf, shared by starci kernel route and starci kernel status).
+  # Running, leased and answering jobs always hold theirs. Re-routing refreshes the hold.
+  routeHoldMs: 900000
+  # worker-start is a managed launch the host refused without classifying it. Two minutes is long
+  # enough for the kernel to reroute the attempt to a different pool, short enough that a one-off
+  # host hiccup does not park a healthy pool for the rest of the leg. prompt-delivery-stalled is its
+  # command-terminal twin: a prompt lost on a stalled send and on its one re-delivery (scripts/agent/lib.mjs).
+  # quota: the fallback only - a provider whose plan reset is configured holds its quota circuit until that reset
+  # plus one probe interval, cleared earlier by its recovery probe.
+  # capacity: the provider refused to serve the model for now (an agent card's capacityExhausted row).
+  cooldownMs: {rate-limited: 600000, quota: 3600000, capacity: 600000, auth: 86400000, other: 300000, worker-start: 120000, prompt-delivery-stalled: 120000}
+  # Observations of one failure kind before its circuit opens. A kind absent here opens on the first:
+  # a provider answering 401 is not a flake, a single refused launch can be.
+  # A circuit that reopens for the same failure inside windowMs waits factor
+  # times longer each time, capped at capMs (scripts/kernel/cli.mjs
+  # writeProviderCircuit). An un-onboarded CLI does not clear in two minutes.
+  circuitBackoff: {factor: 5, capMs: 3600000, windowMs: 3600000}
+  providerStrikes: {worker-start: 2, prompt-delivery-stalled: 2}
+  backoffFactor: 2
+  maxCooldownMs: 3600000
+# The allocator's reading of each kind, from what its op manifest's goal and steps do. `role` is the
+# kinds.yaml role. `work` is `think` when the output is a canonical record (SRS, SDS, scope, goal, decision,
+# brand, ui, Work, workspace, rule) or a verdict about quality, and `hands-on` when the op builds, runs or
+# measures under a record someone else settled. `floor` is the least difficulty the kind routes at:
+# the router raises a measured difficulty to it and never lowers one; the difficulty then names the tier
+# (modules/models/tiers.yaml difficulty), and a kind named under tiers.yaml kindTiers takes that tier instead.
+roleOfKind:
+  request.analyze: {role: plan, work: think, floor: hard}
+  task.execute: {role: plan, work: think, floor: hard}
+  backend.implement: {role: implement, work: hands-on, floor: medium}
+  backend.scaffold: {role: implement, work: hands-on, floor: easy}
+  interface.implement: {role: implement, work: hands-on, floor: medium}
+  interface.audit: {role: verify, work: think, floor: hard}
+  interface.scaffold: {role: implement, work: hands-on, floor: easy}
+  package.scaffold: {role: implement, work: hands-on, floor: easy}
+  scope.define: {role: decide, work: think, floor: hard}
+  code.refactor: {role: implement, work: hands-on, floor: easy}
+  code.fix: {role: implement, work: hands-on, floor: medium}
+  test.author: {role: implement, work: hands-on, floor: easy}
+  grammar.update: {role: implement, work: hands-on, floor: hard}
+  architecture.revise: {role: decide, work: think, floor: hard}
+  business.revise: {role: decide, work: think, floor: hard}
+  content.generate: {role: write, work: hands-on, floor: easy}
+  docs.author: {role: write, work: hands-on, floor: easy}
+  knowledge.repair: {role: write, work: think, floor: hard}
+  release.deliver: {role: implement, work: hands-on, floor: hard}
+  scope.finish: {role: implement, work: hands-on, floor: hard}
+  runtime.operate: {role: implement, work: hands-on, floor: medium}
+  review.verify: {role: verify, work: think, floor: hard}
+  handover.review: {role: verify, work: think, floor: hard}
+  e2e.verify: {role: verify, work: hands-on, floor: medium}
+  integration.verify: {role: verify, work: hands-on, floor: hard}
+  security.verify: {role: verify, work: think, floor: hard}
+  perf.verify: {role: verify, work: hands-on, floor: medium}
+  unit.verify: {role: verify, work: hands-on, floor: medium}
+  uat.verify: {role: verify, work: hands-on, floor: medium}
+  uat.assisted.prepare: {role: write, work: hands-on, floor: medium}
+  uat.assisted.verify: {role: verify, work: think, floor: hard}
+  goal.validate: {role: verify, work: think, floor: hard}
+  architecture.decide: {role: decide, work: think, floor: hard}
+  business.decide: {role: decide, work: think, floor: hard}
+  goal.revise: {role: decide, work: think, floor: hard}
+  decision.prepare: {role: decide, work: think, floor: hard}
+  provision.ask: {role: decide, work: think, floor: hard}
+  brand.decide: {role: write, work: think, floor: hard}
+  interface.draw: {role: write, work: think, floor: hard}
+  interface.asset: {role: write, work: hands-on, floor: hard}
+  work.author: {role: write, work: think, floor: hard}
+  implementation.plan: {role: plan, work: think, floor: hard}
+  workspace.manage: {role: plan, work: think, floor: hard}
+  model.assessGoal: {role: plan, work: think, floor: hard}
+  model.planOp: {role: plan, work: think, floor: hard}
+  model.decide: {role: decide, work: think, floor: hard}
+  model.manageWorkflow: {role: decide, work: think, floor: hard}
+  model.validateOp: {role: verify, work: think, floor: hard}
+  model.critiqueGoal: {role: verify, work: think, floor: hard}
+  judge: {role: verify, work: think, floor: hard}

package/runtime/modules/models/tiers.yaml

@@ -0,0 +1,66 @@
+schema: starci/model-tiers@1
+purpose: >-
+  The ONE owner of which model takes which work. A tier is an ordered chain of members (agent + model, optional
+  effort); the first member with tokens is taken. Tiers are named by capability. A model may sit in several tiers.
+  Adding a tier or a member is a line here (or in config.yaml models.tiers) and needs no code.
+tiers:
+  frontier:
+    - {agent: claude, model: claude-opus-5-5}
+    - {agent: codex, model: gpt-6.1-sol, effort: max}
+  high:
+    - {agent: claude, model: claude-sonnet-5-5}
+    - {agent: codex, model: gpt-6.1-sol, effort: high}
+  medium:
+    - {agent: devin, model: swe-2-max}
+    - {agent: codex, model: gpt-6.1-sol, effort: medium}
+  low:
+    - {agent: devin, model: swe-2-max}
+    - {agent: codex, model: gpt-6-luna, effort: low}
+  imagegen:
+    - {agent: codex, model: gpt-6.1-sol, effort: high}
+# Highest first: a provider with no frontier member takes its member of the first tier that has one.
+tierOrder: [frontier, high, medium, low]
+# Seat -> tier. A seat is a long-lived agent role; an op takes the tier of its difficulty.
+seats:
+  supervisor: frontier
+  planner: frontier
+  validator: frontier
+  kernelManager: frontier
+  kernel: high
+  worker: high
+  critic: frontier
+# The kernel's own model calls (selection.yaml kernelFunctionKinds) take the tier of their seat.
+kindSeats:
+  model.assessGoal: planner
+  model.planOp: planner
+  model.decide: kernelManager
+  model.manageWorkflow: kernelManager
+  model.validateOp: validator
+  model.critiqueGoal: validator
+  model.classifyScreen: kernelManager
+  model.presentOwnerQuestion: kernelManager
+  judge: validator
+difficulty:
+  insane: frontier
+  hard: high
+  medium: medium
+  easy: low
+# A kind named here takes that tier whatever its difficulty; the drawing ops take the tier of their difficulty like every core op.
+kindTiers: {}
+# A tier no seat and no op takes: only a headless call made by one op is made on it (`calls`). A tier not named here is a seat tier.
+tierUse:
+  imagegen: call
+# Headless calls: the call tier whose chain the call is picked from (the same picker: hard filter, bias, balance, token use),
+# the longest one call may run, and the most images and reference images it takes.
+calls:
+  imagegen: {tier: imagegen, timeoutMs: 600000, maxImages: 8, maxReferences: 6}
+# Balance over the recent picks of one tier, running seats included.
+balance:
+  maxStreak: 3
+  maxSharePercent: 70
+# Token use of the chosen member, in percent of its most used quota window. Automatic picks skip a member at
+# `reservePercent`; an owner bias naming the member keeps it usable up to `biasPercent`; `exhaustedPercent` is never used.
+usage:
+  reservePercent: 90
+  biasPercent: 95
+  exhaustedPercent: 100