@starci/hfs 4.0.10 → 4.1.0

package/runtime/modules/models/runtimes.yaml

@@ -2,20 +2,14 @@ schema: starci/runtimes@1
 purpose: |-
   Every runtime is a provider-window pool with real parallel slots and a cooldown: the pool boundary IS the
   quota-window boundary, so one pool never spans two independently metered windows and one window never splits
-  into two pools. The workflow-bound profile applies adaptive capacity from config.yaml: role, tier, tools,
-  qualification, independent review, fresh provider quota, shared admitted load and recent observed service
-  filter and score provider families before one runtime is handed to the typed launcher. The preference/tier
-  lists below are within-family suitability and a compatibility policy for direct low-level consumers; they are
-  not a provider fallback chain in a workflow. A runtime that fails is classified and parked for the cooldown of
-  that failure kind, doubling per repeat. Auth health is provider-wide rather than pool-wide: a confirmed
-  launch, worker-start or attestation auth rejection parks every runtime sharing that provider credential. A
-  stale-token preflight may make one real refresh attempt; a typed no-effect rejection falls through on the
-  same logical operation attempt, while partial or unknown effects require reconciliation before fallback.
-
-  Models are pinned inside the pool per DIFFICULTY (`models`) and attested at launch - never inferred from the
-  pool name. The pools themselves — membership, `provider`, `roles`, `maxParallel`, per-difficulty `models`
-  and `effort` pins, `defaultModel` — live in modules/models/registry.yaml `pools`, the ONE model catalog;
-  this file keeps only the operational allocation policy and runtime tuning that is not model data.
+  into two pools. Which model takes which work is modules/models/tiers.yaml; the pools themselves live in
+  modules/models/registry.yaml `pools`. This file keeps the operational allocation policy and runtime tuning that is
+  not model data. A runtime that fails is classified and parked for the cooldown of that failure kind, doubling per
+  repeat and capped (cooldownMs, circuitBackoff, maxCooldownMs: every park is time-bounded and expires by itself).
+  Auth health is provider-wide rather than pool-wide: a confirmed launch, worker-start or attestation auth rejection
+  parks every runtime sharing that provider credential. A stale provider token is not admitted (the owner
+  re-authenticates in Orca); a typed no-effect rejection falls through on the same logical operation attempt, while
+  partial or unknown effects require reconciliation before fallback.
 # `maxParallelOps` is the worker-wide ceiling across every workflow; `budgets.maxOps` in the owner's
 # config.yaml is the per-workflow one. The lower of the two admits: engine/admission.mjs
 # opSlotCeiling takes min(budgets.maxOps, maxParallelOps) and scripts/kernel/cli.mjs refuses
@@ -26,181 +20,21 @@ allocation:
   admission:
     schema: starci/agent-admission-policy@1
     version: 1
-    reservePercent: 90
-    exhaustedPercent: 100
+    # Age limit of evidence the runtime observes itself at admission time: owner grants and direct probes (Devin).
     maxAgeMs: 300000
+    # Age limit of provider windows the host polls (Orca account entries). Orca refreshes usage while its window is
+    # focused and after agent sessions end; the runtime cannot request a refresh. A launch against an exhausted window
+    # is refused by the provider and classified by the provider circuit. Never below maxAgeMs.
+    hostPolledMaxAgeMs: 86400000
     qualityOrder: [economy, standard, frontier]
-    ownerBiasRoles: [op]
+    ownerBiasRoles: [op, kernel, supervisor, worker, critic]
     eligibilityModes: [qualified, probation, kernel-function, scoped-control-plane, operation-policy]
     roles:
       kernel: {qualityFloor: standard}
-      op:
-        qualityFloor: economy
-        difficultyFloors: {easy: economy, medium: economy, hard: frontier, insane: frontier}
+      op: {qualityFloor: economy}
       supervisor: {qualityFloor: standard}
       worker: {qualityFloor: standard}
       critic: {qualityFloor: standard, independence: provider}
-  # The default policy. config.yaml allocation.policy overrides it for `starci kernel route` (engine/config.mjs
-  # configuredAllocationPolicy): prefer-then-overflow takes the first eligible pool of the tier order below;
-  # balanced walks the eligible pools of that order and takes the FIRST one still below its config.yaml
-  # allocation.shares target of the recent dispatches (scripts/agent/balance.mjs counts them; scripts/agent/
-  # models.mjs selectPool picks), so the evidence order ranks and the share caps; when every eligible pool
-  # is at or above its share, the one furthest below (least over) takes it and the order breaks ties. Under
-  # both, every gate (role, difficulty pin, owner grant, host tools, quota/auth, circuit, maxParallel)
-  # applies first.
-  policy: prefer-then-overflow
-  # Under balanced, a pool listed here for a work class and tier is taken only when no other pool of the
-  # order is eligible: Opus stays hands-on overflow below insane, so its share is spent on think work; at
-  # insane, where only Opus and Sol pin a model, the two balance.
-  balanced:
-    overflowOnly:
-      hands-on:
-        easy: [claude-agent]
-        medium: [claude-agent]
-        hard: [claude-agent]
-  # Owner decision 2026-09-25 (review-hands, amending routing-by-evidence): a pool an order lists here is taken
-  # only when no other pool of that order is eligible, under EITHER policy - neither the balanced share nor the
-  # owner's goal routing_bias prefer moves it ahead. Opus and Sol are the review order's overflow: they take a review only when
-  # Devin is unavailable (circuit open, quota dead, full, or excluded by the cross-family rule).
-  overflowByOrder:
-    review: [claude-agent, codex-agent]
-  # Cross-family audit: a verify kind whose records overlap the output of the latest settled non-verify op of
-  # the workflow (scripts/kernel/cli.mjs cmdRoute finds that author with scripts/agent/balance.mjs
-  # auditAuthorOf) routes to an eligible pool of another audit family - the reviewer's provider differs from
-  # the implementer's. The audit families are the pools of `frontier` and `hands`: Opus or Sol review what
-  # Devin implemented; Sol reviews Opus's records and Opus reviews Sol's. The author's
-  # own family is taken only when no pool of another family is eligible (crossFamily.applied false).
-  # thinkAuditCrossFamily keeps its name from when only think verdicts were audited.
-  thinkAuditCrossFamily: true
-  # The frontier think group: Claude Opus 5.5 and GPT-6.1 Sol. It is what the kernel's own model calls route
-  # over (scripts/route/route-model.mjs decisionFlow kernel-function) and two families of the cross-family
-  # audit above.
-  frontier: [claude-agent, codex-agent]
-  # The hands group: Devin (SWE-2 Max). It implements and, since the owner decision of 2026-09-25
-  # (review-hands), reviews - the third audit family.
-  hands: [devin-agent]
-  # Owner decision 2026-09-25 ("ok"): route by the 72h evidence of scripts/agent/model-scorecard.mjs (1389 op jobs over the product ledgers of that window).
-  # Those historical Sol scores describe the pre-migration model; they are not GPT-6.1 Sol qualification evidence.
-  # Each kind walks ONE order, named by its roleOfKind `order` (default: `think` for think work, else its role),
-  # at its difficulty tier:
-  #   implement, write, verify (hands-on implementation: backend.implement, interface.implement, code.refactor,
-  #     test.author, the hands-on verify kinds, release/scope finish): Devin first, then Codex and Claude -
-  #     Devin passed 70% of backend.implement and 68% of interface.implement over the 72h scorecard.
-  #   scaffold (scaffold, docs, content, grammar.update - small work - and every cut slice of a fan-out, which
-  #     scripts/kernel/cli.mjs cmdRoute routes on this order): Devin first - backend.scaffold passed 73% on Devin,
-  #     43% on Codex over the 72h scorecard.
-  #   think, decide, plan (every think kind: decide, review and author ops): Claude Opus first, GPT-6.1 Sol second
-  #     and nothing else - Opus passed 72-73% of business/architecture.decide, Sol 60-64%. Think kinds route at a hard floor, where codex-agent pins Sol; the
-  #     easy and medium keys (Claude only, never Luna) exist for direct role consumers that bring no kind.
-  #   draw (interface.draw; owner ruling 2026-09-27 draw-devin-brand-claude, modules/kernel/owner-rulings.yaml):
-  #     Devin draws first (SWE-2 Max; token-render HTML + Playwright in the product checkout - its card carries
-  #     browser-dom), Codex (GPT-6.1 Sol at effort high) is the fallback. The raster regions a drawing needs are
-  #     artworkSlots for interface.asset, never painted by the drawer. Devin pins no easy or insane model, so the easy
-  #     and insane keys are Codex alone. The draw loop's independent critic stays a DIFFERENT model from the drawer
-  #     (allocation.drawLoop.critic, criticWhenDrawer).
-  #   asset (interface.asset): Codex only - the one agent with the image tool (image_gen.imagegen).
-  #   brand (brand.decide; owner ruling 2026-09-27 draw-devin-brand-claude): Claude Opus decides the brand and its
-  #     direction, GPT-6.1 Sol is the fallback when the Claude pool cannot serve; Codex is also the cross-family second
-  #     opinion on think work.
-  #   review (owner decision 2026-09-25 review-hands, amending the think order above: "codex/claude only
-  #     decide (that is, set the strategy), review must be done by the hands"): every verify kind -
-  #     review.verify, handover.review, security.verify, goal.validate, uat.assisted.verify, interface.audit and
-  #     the hands-on e2e/integration/perf/uat verify kinds - and work.author walk the review order: Devin,
-  #     then Opus and Sol as overflow only (overflowByOrder.review). The cross-family rule sends a review of
-  #     what Devin implemented to Opus or Sol. An experiment, measured in
-  #     benchmark/findings/2026-09-25-review-hands.md.
-  # Claude and Codex keep strategy: request.analyze, scope.define, business/architecture/goal decide and
-  # revise, decision.prepare and implementation.plan (the cut) stay on think/decide/plan (Opus, Sol); brand.decide
-  # walks its own brand order (Opus, then Sol).
-  # interface.audit needs the browser-dom host tool: Devin and Codex carry it, Claude does not, so the
-  # host-tool gate passes Claude over (Devin audited it at 11% pass, 83% fail over the 72h scorecard -
-  # the experiment re-measures it).
-  # Devin (SWE-2-max) pins no easy or insane model, so easy hands-on work starts at Codex (Luna) and insane
-  # hands-on work at the frontier pools; Opus stays hands-on overflow below insane.
-  # Owner routing 2026-09-26: Opus brainstorms and decides (think/decide/plan orders); Sol draws, audits the UI
-  # and verifies e2e/security/assisted UAT (order ui: Devin as fallback when the Codex quota circuit
-  # opens); Devin implements, run the kernel and do the mechanical ops (provision.ask, workspace.manage,
-  # task.execute, knowledge.repair walk implement); the kernel's own model calls walk sol-think (Sol, Opus overflow).
-  tiers:
-    hard:
-      default: [devin-agent, codex-agent, claude-agent]
-      implement: [devin-agent, codex-agent, claude-agent]
-      write: [devin-agent, codex-agent, claude-agent]
-      verify: [devin-agent, codex-agent, claude-agent]
-      scaffold: [devin-agent, codex-agent, claude-agent]
-      think: [claude-agent, codex-agent]
-      decide: [claude-agent, codex-agent]
-      plan: [claude-agent, codex-agent]
-      draw: [devin-agent, codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [devin-agent, claude-agent, codex-agent]
-      ui: [codex-agent, devin-agent]
-      sol-think: [codex-agent, claude-agent]
-    medium:
-      default: [devin-agent, codex-agent, claude-agent]
-      implement: [devin-agent, codex-agent, claude-agent]
-      write: [devin-agent, codex-agent, claude-agent]
-      verify: [devin-agent, codex-agent, claude-agent]
-      scaffold: [devin-agent, codex-agent, claude-agent]
-      think: [claude-agent]
-      decide: [claude-agent]
-      plan: [claude-agent]
-      draw: [devin-agent, codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [devin-agent, claude-agent, codex-agent]
-      ui: [codex-agent, devin-agent]
-      sol-think: [codex-agent, claude-agent]
-    easy:
-      default: [codex-agent, claude-agent]
-      implement: [codex-agent, claude-agent]
-      write: [codex-agent, claude-agent]
-      verify: [codex-agent, claude-agent]
-      scaffold: [codex-agent, claude-agent]
-      think: [claude-agent]
-      decide: [claude-agent]
-      plan: [claude-agent]
-      draw: [codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [claude-agent, codex-agent]
-      ui: [codex-agent]
-      sol-think: [codex-agent, claude-agent]
-    # Insane tops the ladder: only pools that declare an insane model can serve it. Devin carries no insane
-    # pin and is ineligible here by the models gate, so it is absent rather than listed-and-rejected (an insane
-    # review is Opus's, with Sol as overflow).
-    insane:
-      default: [claude-agent, codex-agent]
-      implement: [claude-agent, codex-agent]
-      write: [claude-agent, codex-agent]
-      verify: [claude-agent, codex-agent]
-      scaffold: [claude-agent, codex-agent]
-      think: [claude-agent, codex-agent]
-      decide: [claude-agent, codex-agent]
-      plan: [claude-agent, codex-agent]
-      draw: [codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [claude-agent, codex-agent]
-      ui: [codex-agent]
-      sol-think: [codex-agent, claude-agent]
-  # config.yaml allocation.preferredProvider is a bias within the tier's eligible pools and never moves think
-  # work to a pool outside `think` (scripts/route/route-model.mjs).
-  preference:
-    implement: [devin-agent, codex-agent, claude-agent]
-    verify: [devin-agent, codex-agent, claude-agent]
-    write: [devin-agent, codex-agent, claude-agent]
-    scaffold: [devin-agent, codex-agent, claude-agent]
-    think: [claude-agent, codex-agent]
-    decide: [claude-agent, codex-agent]
-    plan: [claude-agent, codex-agent]
-    draw: [devin-agent, codex-agent]
-    asset: [codex-agent]
-    brand: [claude-agent, codex-agent]
-    review: [devin-agent, claude-agent, codex-agent]
-    ui: [codex-agent, devin-agent]
-    sol-think: [codex-agent, claude-agent]
   # Heavy work fans out: a big node is cut into children with disjoint write scopes, the seam every other child
   # would touch is built first and alone, then the rest run at once - bounded here so one parent never takes
   # every slot of the pool and leaves the rest of the tree waiting behind it.
@@ -212,10 +46,8 @@ allocation:
   # bounds in kinds.yaml (12 files / 8 assertions / 3 components) are a coarse screen over the same
   # measure — the estimate is the authority. When N > 1 slices are admitted together the kernel
   # routes them one after the other with plain starci kernel route (a Kernel --prefer/--avoid is ignored, owner
-  # decision 2026-09-25) so the workers spread over the lanes instead of piling onto the first pool. A
-  # hands-on slice (payload.cut) walks the scaffold order, Devin first (owner decision 2026-09-25): each
-  # routed slice is already counted before the next one is routed, and a pool that reaches its share
-  # passes the next slice down the order.
+  # decision 2026-09-25) so the workers spread over the lanes instead of piling onto the first pool. Each
+  # routed slice is recorded as a pick before the next one is routed, so the balance step spreads the slices.
   # A gear never raises a pool's maxParallel, maxParallelOps or budgets.maxOps: it raises only what
   # `starci kernel estimate` requests, and admission still clamps it.
   slicing:
@@ -228,8 +60,7 @@ allocation:
     # `l.from.files: 12` is ledger-derived: of 52 settled implement/refactor/author jobs in the
     # measured product ledger, closures at or above 12 authored files ran a median 46 min against 12 min below
     # it, the first cutoff where the majority exceeds one targetMinutes[1] window
-    # (benchmark/findings/2026-09-23-parallel-gear.md). Every other `from` bound is the
-    # benchmark/findings/fable.md sketch value carried as an ASSUMPTION: that ledger holds exactly one job over three
+    #. Every other `from` bound is a sketch value carried as an ASSUMPTION: that ledger holds exactly one job over three
     # windows and no assertion or component measurement at all, so `xl.from` and both `assertions`
     # bounds have no observation behind them and are re-derived when estimate inputs are recorded.
     size:
@@ -240,6 +71,9 @@ allocation:
   # and nowhere else.
   dispatchLeaseTtlMs: 1800000
   watchdogCadenceMs: 300000
+  # usageEveryMs: the token meter's sweep interval (host controller duty host/usage, scripts/kernel/usage-record.mjs). An attempt that ended less
+  # than this ago is still being metered: the autopilot budget does not count its missing usage as unknown (scripts/kernel/autopilot-budget.mjs).
+  usageEveryMs: 300000
   observeCadenceMs: 180000
   # activeStaleMs: an `active` screen (spinner/"Working" row) is trusted only while the terminal still
   # prints; a spinner re-renders every second, so output older than this is a frozen frame. The watchdog
@@ -275,9 +109,8 @@ allocation:
   # start waits for an Orca that does not answer, and how long after a responding Orca calls a kernel dead
   # it is asked again.
   hostOutage: {waitMs: 90000, deathSettleMs: 10000}
-  # supervisorTick: the numbers of the retired supervisor tick (2026-09-28) that the reconciler controllers still read
-  # (host thresholds, orca probes, statusApp port, owner digest cadence); everyMs is unused. The tick ran every
-  # everyMs (whole minutes: schtasks repetition). host: above maxNode node.exe or maxGit git.exe processes the host
+  # supervisorTick: the numbers the reconciler controllers read
+  # (host thresholds, orca probes, statusApp port, owner digest cadence). host: above maxNode node.exe or maxGit git.exe processes the host
   # controller logs the counts and the parents holding the most. orca: terminal-list is probed up to probes times, probeTimeoutMs each, gapMs apart; when every
   # probe fails the Orca app (never its terminal daemon) gets closeWaitMs to close before it is forced, is launched
   # again, and restart-all runs. deadKernelMs: a watchdog whose trailing ticks read tick-failed or restart-failed
@@ -290,7 +123,6 @@ allocation:
   # actions.mjs) no supervisor action touched this long is an SLA breach, alerted into the Supervisor's inbox.
   # ownerDigestMs: the Owner Notifier's periodic owner digest goes out at most this often.
   supervisorTick:
-    everyMs: 1800000
     host: {maxNode: 300, maxGit: 100}
     orca: {probeTimeoutMs: 30000, probes: 5, gapMs: 30000, closeWaitMs: 20000}
     deadKernelMs: 900000
@@ -344,16 +176,17 @@ allocation:
     releaseWindowMs: 86400000
     tail: {retryMs: 120000, maxAttempts: 5}
   # redesign (starci kernel redesign; owner 2026-09-28: heavy redesign is dispatched to the op that owns it, and the Kernel stays on
-  # Devin): these ops, enqueued from an RCA, route as `routeAs` (implementation.plan: the plan order - Opus, then Sol) at
-  # >= minDifficulty at `effort` whatever their usual order (work.author walks the review order, Devin first, otherwise).
+  # Devin): these ops, enqueued from an RCA, route as `routeAs` (implementation.plan) at
+  # >= minDifficulty at `effort`.
   redesign:
     ops: [work.author, scope.define, goal.revise]
     routeAs: implementation.plan
     minDifficulty: hard
     effort: high
   # selfReload (scripts/machine/self-reload.mjs): a watchdog loop re-execs at most once per minIntervalMs; its
-  # replacement takes over the loop's lock within handoverMs or is stopped.
-  selfReload: {minIntervalMs: 300000, handoverMs: 30000}
+  # replacement takes over the loop's lock within handoverMs or is stopped. The reconciler engine checks every checkMs; an engine whose
+  # revision still differs from the live one that long past minIntervalMs + checkMs + handoverMs is a drift row (scripts/reconciler/drift.mjs).
+  selfReload: {minIntervalMs: 300000, handoverMs: 30000, checkMs: 60000, driftGraceMs: 120000}
   # footprint (scripts/guards/footprint-scan.mjs): one host-wide scan at most every everyMs; a crashed
   # tick's claim lock is cleared after lockStaleMs.
   footprint: {everyMs: 600000, lockStaleMs: 60000}
@@ -365,7 +198,17 @@ allocation:
   # workerClose (scripts/machine/worker-close.mjs; owner rule: a finished worker is closed COMPLETELY): after worker-release and the terminal
   # close the runtime waits verifyMs for every process of that terminal's shell tree to end (polled every pollMs); a survivor proven to belong
   # to the tree is stopped and given stopVerifyMs to end before the finding is raised.
-  workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000}
+  # A finished [Worker] job whose terminal has no recorded closure is closed again by the Job controller's worker sweep (scripts/supervisor/supervisor-watchdog.mjs):
+  # every leftoverRetryMs (doubling to leftoverRetryMaxMs) for at most leftoverRetryAttempts attempts, each failure recorded with its reason on the job.
+  workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000, leftoverRetryMs: 60000, leftoverRetryMaxMs: 900000, leftoverRetryAttempts: 12}
+  # providerReservation (scripts/machine/provider-reservation-reap.mjs): an admission whose receipt stayed `reserved` this long never reached
+  # worker-start (the consume moves it to `launching` first), so its launcher died and the slot is released. A receipt with no terminal handle and no
+  # process is released once the host restarted after its last update (scripts/machine/provider-reservation-restart.mjs); restartToleranceMs is the
+  # margin the restart instant must clear that update by. A handle-less receipt no proof reaches opens the PROVIDER_RESERVATION_HELD clock after unknownHeldMs.
+  providerReservation: {reservedStaleMs: 900000, unknownHeldMs: 1800000, restartToleranceMs: 5000}
+  # hostLock (scripts/machine/verb-lock.mjs): a verb that finds the host lock held (npm ci, npm install) retries on the retry budget
+  # of scripts/lib/retry-budget.mjs (the interval doubles to retryMaxIntervalMs) until retryDeadlineMs, then refuses with every attempt named.
+  hostLock: {retryIntervalMs: 5000, retryMaxIntervalMs: 30000, retryDeadlineMs: 180000}
   # waiterPriority (scripts/kernel/waiter-priority.mjs): a queued job that has blocked another
   # workflow this long earns its Kernel one heads-up per newly waiting workflow.
   waiterPriority: {blockingHeadsUpMs: 900000}
@@ -404,9 +247,10 @@ allocation:
   # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: started
   # through orchestration worker-start --agent <provider> --model --effort (scripts/agent/lib.mjs startAgent) on a
   # runtime worktree detached at the empty tree (draw-critic.mjs criticWorkspace; Orca refuses a bare temp dir) holding only the PNGs, the HTML and the rubric; it writes verdict.json and reports worker_done; a
-  # critic with no worker_done within timeoutMs is stopped and released (outcome timeout, no beauty). The critic is a DIFFERENT model from the drawer (owner ruling 2026-09-27
-  # draw-devin-brand-claude): Devin draws, Codex critiques; when the drawer (the op's provider, bound to its
-  # terminal - scripts/guards/op-context.mjs - or draw-loop.mjs round --drawer) is the critic's provider - Codex drawing as the draw order's fallback - the round is
+  # critic with no worker_done within timeoutMs is stopped and released (outcome timeout, no beauty). The critic is a DIFFERENT model from the drawer: a Codex drawer (the high tier's second member)
+  # is judged by criticWhenDrawer.codex; for any other drawer the critic is Codex. The images a drawer asks of the imagegen call
+  # (starci work imagegen) do not make the call's model the drawer. When the drawer (the op's provider, bound to its
+  # terminal - scripts/guards/op-context.mjs - or draw-loop.mjs round --drawer) is the critic's provider the round is
   # judged by criticWhenDrawer.<drawer> instead, and a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
   # archetype for its ui record's ui.archetype - brand.mjs checkDirection evidence.ready, the owner's receipt
   # (scripts/kernel/prerequisites.mjs direction-unaccepted; the Kernel enqueues brand.decide --param
@@ -439,7 +283,8 @@ allocation:
   #     need it wait for the one end-of-flow credential checklist (provision.ask subject handover-credentials);
   #   - a retry cap or an owner-gate that is really a runtime/process issue is a supervisor-gate incident (the
   #     Supervisor fixes or decides the retry), supervisorExtraBudget gates per node group, then the leg is
-  #     deferred; an unresolved supervisor-gate older than supervisorGateTimeoutMs defers what it holds;
+  #     deferred; an unresolved supervisor-gate older than supervisorGateTimeoutMs defers what it holds once the owner was told
+  #     (its Supervisor item reached the owner level: modules/kernel/op-incident-policy.yaml gate.deferAfter);
   #   - budgets caps one workflow (non-kernel jobs, token total recorded on jobs, wall time since start): past
   #     one, a supervisor-gate holds new dispatch until the Supervisor extends the budget.
   autopilot:
@@ -472,7 +317,7 @@ allocation:
   # archiveMaxAgeMs are deleted outright. lanesRoot is where lane worktrees sit; a landed lane is
   # removed only once its branch reflog, HEAD reflog and directory stayed unchanged for laneGraceMs
   # (a fresh lane with no commit yet reads as landed to git cherry); unset, no lane is removed.
-  # logMaxAgeMs caps every jsonl and log under %LOCALAPPDATA%/StarCi and ~/.starci.
+  # logMaxAgeMs caps every jsonl and log under the state base (<runtime root>/.runtime) and ~/.starci.
   # gitIndexLockStaleMs: a product checkout's .git/index.lock older than this, with no git process on
   # that repository (one naming no repository counts as on it), is removed by
   # scripts/api/git/index-lock.mjs - from the op worker's git shim before git runs, and by the
@@ -488,12 +333,16 @@ allocation:
       work-acceptance-, work-brand-test-, work-core-test-, work-custody-test-, work-external-,
       work-index-md-, work-module-spec-, example-critique-, example-derive-, example-evidence-, example-verify-,
       example-work-gate-, work-artifacts-, work-consistency-, work-surfaces-,
-      grammar-land-, kernel-replace-close-, nm-link-, rc-job-, rc-health-, release-gate-, seat-titles-, slice-typecheck-, unit-roles-, spec-budget-]
+      grammar-land-, kernel-replace-close-, nm-link-, rc-job-, rc-health-, release-gate-, seat-titles-, slice-typecheck-, unit-roles-, spec-budget-,
+      model-hotload-, price-hotload-, owner-trust-, fs-kind-contract-, private-publication-, private-create-, private-lease-, private-partial-,
+      private-unknown-, private-inode-, private-bound-, private-link-, private-prefix-, check-entry-, core-tree-, runtime-public-docs-, blob-publication-,
+      core-debug-schema-, ledger-native-case-, sbx-spec-, runtime-artifact-, gc-archive-proof-, machine-retention-, zip-resource-,
+      core-seat-, core-diag-]
     sessionArchiveAfterMs: 259200000
     claudeTranscriptArchiveAfterMs: 604800000
     archiveMaxAgeMs: 2592000000
     # archiveRoot and lanesRoot are unset on purpose: no host location lives in a tracked file. The defaults are
-    # <starciLocalRoot>/archive and <starciLocalRoot>/lanes (scripts/machine/home.mjs archiveRoot, lanesRoot); the owner
+    # <starciLocalRoot>/archive (<runtime root>/.runtime/archive) and a per-user lanes directory outside the checkout (scripts/machine/home.mjs archiveRoot, lanesRoot); the owner
     # relocates them with STARCI_ARCHIVE_ROOT and STARCI_LANES_ROOT or by setting these keys on the host.
     laneGraceMs: 86400000
     logMaxAgeMs: 1209600000
@@ -519,10 +368,12 @@ allocation:
   # heartbeatStaleMs; one starci kernel status snapshot per workflow is shared for statusCacheMs; a failing key backs off
   # backoff.minMs doubling to backoff.maxMs; more than crashLoop.max engine starts in crashLoop.windowMs start it
   # --safe (read-only) and push the owner one urgent Telegram (boot.mjs).
-  reconciler: {pollMs: 2000, leaseMs: 30000, renewMs: 10000, heartbeatStaleMs: 60000, statusCacheMs: 20000, backoff: {minMs: 1000, maxMs: 300000}, crashLoop: {max: 3, windowMs: 1800000}}
-  # resources: the host-floor guards the provider-health / admission path reads. Below minFreeDiskGb
+  reconciler: {pollMs: 2000, leaseMs: 30000, renewMs: 10000, heartbeatStaleMs: 60000, statusCacheMs: 20000, backoff: {minMs: 1000, maxMs: 300000, maxAttempts: 24}, crashLoop: {max: 3, windowMs: 1800000}, modeDriftMs: 60000}
+  # resources: the host-floor guards the provider-health / admission path reads. These are the shipped defaults; the owner's
+  # config.yaml `resources` (minFreeDiskGb, minFreeDiskPct, minFreeRamPct) overrides them key by key and code holds no number of its own.
+  # Below the disk floor (minFreeDiskGb, or minFreeDiskPct of the drive's size when the owner sets it - the larger applies)
   # `starci kernel dispatch --spawn` refuses host-resources-low until there is room again - measured on the
-  # drive that holds %TEMP% and the repos. RAM goes through the RAM-aware, priority-aware throttle
+  # drives that hold the configured temp root (config.yaml roots.temp, else the OS temp directory) and the repos. RAM goes through the RAM-aware, priority-aware throttle
   # (scripts/machine/ram-throttle.mjs; owner ruling 2026-09-28 "Parallelism ceiling follows real RAM: free RAM below 15%
   # then reduce the number of parallel ops, avoid freezing the machine and killing ops mid-run"): at every dispatch the effective cap
   # is min(maxParallelOps, running + the ops that fit in free RAM above hardFloorPct of total), counted across
@@ -534,7 +385,7 @@ allocation:
   # same way until it falls below cpuHeavyResumeBelow. Running ops are never stopped. Owner ruling 2026-09-28
   # ("15→10, 10→2.5"): the heavy floor 10% resuming at 15%, critical 2.5% resuming at 5%, the fit floor 2.5%.
   resources:
-    minFreeDiskGb: 20
+    minFreeDiskGb: 5
     minFreeRamPct: 10
     ramThrottle:
       heavyResumeAbovePct: 15
@@ -605,9 +456,6 @@ allocation:
   # readiness loop does not starve the pool (scripts/kernel/cli.mjs poolLoadOf, shared by starci kernel route and starci kernel status).
   # Running, leased and answering jobs always hold theirs. Re-routing refreshes the hold.
   routeHoldMs: 900000
-  verifyAvoidsImplementRuntime: true
-  onLaunchFailure: next-available-runtime
-  tieBreak: round-robin
   # worker-start is a managed launch the host refused without classifying it. Two minutes is long
   # enough for the kernel to reroute the attempt to a different pool, short enough that a one-off
   # host hiccup does not park a healthy pool for the rest of the leg. prompt-delivery-stalled is its
@@ -629,67 +477,55 @@ allocation:
 # kinds.yaml role. `work` is `think` when the output is a canonical record (SRS, SDS, scope, goal, decision,
 # brand, ui, Work, workspace, rule) or a verdict about quality, and `hands-on` when the op builds, runs or
 # measures under a record someone else settled. `floor` is the least difficulty the kind routes at:
-# scripts/agent/models.mjs selectPool raises a measured difficulty to it and never lowers one. Every think
-# kind's floor is hard, the tier where every think pool pins a frontier model. The kernel's own model
-# calls (selection.yaml kernelFunctionKinds) are think work at the same floor. `order` names the allocation
-# tiers/preference key the kind walks when it is not the default (`think` for think work, else the role):
-# `scaffold` (Devin first) for scaffold, docs, content and grammar work, `draw` (Devin first, Codex Sol at effort high
-# the fallback) for interface.draw, `asset` (Codex only, the image tool) for interface.asset, `brand` (Opus first, Sol
-# the fallback) for brand.decide, `review` (Devin, Opus and Sol overflow) for the remaining verify kinds and
-# work.author (owner decision 2026-09-25 review-hands), `ui` (Codex first, Devin as fallback) for
-# interface.audit, e2e.verify, security.verify and uat.assisted.verify, `implement` for the mechanical
-# think ops the hands take whatever their kind role - provision.ask, workspace.manage, task.execute and
-# knowledge.repair - and `sol-think` (Sol first, Opus overflow) for the kernel's own model calls, verify
-# calls included (owner routing 2026-09-26). work.author authors Work records - the write role, as in
-# modules/models/kinds.yaml - so the hands pools, which carry no plan role, can take it; its cut form,
-# implementation.plan, stays plan work on the think order.
+# the router raises a measured difficulty to it and never lowers one; the difficulty then names the tier
+# (modules/models/tiers.yaml difficulty), and a kind named under tiers.yaml kindTiers takes that tier instead.
 roleOfKind:
   request.analyze: {role: plan, work: think, floor: hard}
-  task.execute: {role: plan, work: think, floor: hard, order: implement}
+  task.execute: {role: plan, work: think, floor: hard}
   backend.implement: {role: implement, work: hands-on, floor: medium}
-  backend.scaffold: {role: implement, work: hands-on, floor: easy, order: scaffold}
+  backend.scaffold: {role: implement, work: hands-on, floor: easy}
   interface.implement: {role: implement, work: hands-on, floor: medium}
-  interface.audit: {role: verify, work: think, floor: hard, order: ui}
-  interface.scaffold: {role: implement, work: hands-on, floor: easy, order: scaffold}
-  package.scaffold: {role: implement, work: hands-on, floor: easy, order: scaffold}
+  interface.audit: {role: verify, work: think, floor: hard}
+  interface.scaffold: {role: implement, work: hands-on, floor: easy}
+  package.scaffold: {role: implement, work: hands-on, floor: easy}
   scope.define: {role: decide, work: think, floor: hard}
   code.refactor: {role: implement, work: hands-on, floor: easy}
   test.author: {role: implement, work: hands-on, floor: easy}
-  grammar.update: {role: implement, work: hands-on, floor: hard, order: scaffold}
+  grammar.update: {role: implement, work: hands-on, floor: hard}
   architecture.revise: {role: decide, work: think, floor: hard}
   business.revise: {role: decide, work: think, floor: hard}
-  content.generate: {role: write, work: hands-on, floor: easy, order: scaffold}
-  docs.author: {role: write, work: hands-on, floor: easy, order: scaffold}
-  knowledge.repair: {role: write, work: think, floor: hard, order: implement}
+  content.generate: {role: write, work: hands-on, floor: easy}
+  docs.author: {role: write, work: hands-on, floor: easy}
+  knowledge.repair: {role: write, work: think, floor: hard}
   release.deliver: {role: implement, work: hands-on, floor: hard}
   scope.finish: {role: implement, work: hands-on, floor: hard}
   runtime.operate: {role: implement, work: hands-on, floor: medium}
-  review.verify: {role: verify, work: think, floor: hard, order: review}
-  handover.review: {role: verify, work: think, floor: hard, order: review}
-  e2e.verify: {role: verify, work: hands-on, floor: medium, order: ui}
-  integration.verify: {role: verify, work: hands-on, floor: hard, order: review}
-  security.verify: {role: verify, work: think, floor: hard, order: ui}
-  perf.verify: {role: verify, work: hands-on, floor: medium, order: review}
-  unit.verify: {role: verify, work: hands-on, floor: medium, order: review}
-  uat.verify: {role: verify, work: hands-on, floor: medium, order: review}
+  review.verify: {role: verify, work: think, floor: hard}
+  handover.review: {role: verify, work: think, floor: hard}
+  e2e.verify: {role: verify, work: hands-on, floor: medium}
+  integration.verify: {role: verify, work: hands-on, floor: hard}
+  security.verify: {role: verify, work: think, floor: hard}
+  perf.verify: {role: verify, work: hands-on, floor: medium}
+  unit.verify: {role: verify, work: hands-on, floor: medium}
+  uat.verify: {role: verify, work: hands-on, floor: medium}
   uat.assisted.prepare: {role: write, work: hands-on, floor: medium}
-  uat.assisted.verify: {role: verify, work: think, floor: hard, order: ui}
-  goal.validate: {role: verify, work: think, floor: hard, order: review}
+  uat.assisted.verify: {role: verify, work: think, floor: hard}
+  goal.validate: {role: verify, work: think, floor: hard}
   architecture.decide: {role: decide, work: think, floor: hard}
   business.decide: {role: decide, work: think, floor: hard}
   goal.revise: {role: decide, work: think, floor: hard}
   decision.prepare: {role: decide, work: think, floor: hard}
-  provision.ask: {role: decide, work: think, floor: hard, order: implement}
-  brand.decide: {role: write, work: think, floor: hard, order: brand}
-  interface.draw: {role: write, work: think, floor: hard, order: draw}
-  interface.asset: {role: write, work: hands-on, floor: medium, order: asset}
-  work.author: {role: write, work: think, floor: hard, order: review}
+  provision.ask: {role: decide, work: think, floor: hard}
+  brand.decide: {role: write, work: think, floor: hard}
+  interface.draw: {role: write, work: think, floor: hard}
+  interface.asset: {role: write, work: hands-on, floor: hard}
+  work.author: {role: write, work: think, floor: hard}
   implementation.plan: {role: plan, work: think, floor: hard}
-  workspace.manage: {role: plan, work: think, floor: hard, order: implement}
-  model.assessGoal: {role: plan, work: think, floor: hard, order: sol-think}
-  model.planOp: {role: plan, work: think, floor: hard, order: sol-think}
-  model.decide: {role: decide, work: think, floor: hard, order: sol-think}
-  model.manageWorkflow: {role: decide, work: think, floor: hard, order: sol-think}
-  model.validateOp: {role: verify, work: think, floor: hard, order: sol-think}
-  model.critiqueGoal: {role: verify, work: think, floor: hard, order: sol-think}
-  judge: {role: verify, work: think, floor: hard, order: sol-think}
+  workspace.manage: {role: plan, work: think, floor: hard}
+  model.assessGoal: {role: plan, work: think, floor: hard}
+  model.planOp: {role: plan, work: think, floor: hard}
+  model.decide: {role: decide, work: think, floor: hard}
+  model.manageWorkflow: {role: decide, work: think, floor: hard}
+  model.validateOp: {role: verify, work: think, floor: hard}
+  model.critiqueGoal: {role: verify, work: think, floor: hard}
+  judge: {role: verify, work: think, floor: hard}

package/runtime/modules/models/tiers.yaml

@@ -0,0 +1,65 @@
+schema: starci/model-tiers@1
+purpose: >-
+  The ONE owner of which model takes which work. A tier is an ordered chain of members (agent + model, optional
+  effort); the first member with tokens is taken. Tiers are named by capability. A model may sit in several tiers.
+  Adding a tier or a member is a line here (or in config.yaml models.tiers) and needs no code.
+tiers:
+  frontier:
+    - {agent: claude, model: claude-opus-5-5}
+    - {agent: codex, model: gpt-6.1-sol, effort: max}
+  high:
+    - {agent: claude, model: claude-sonnet-5-5}
+    - {agent: codex, model: gpt-6.1-sol, effort: high}
+  medium:
+    - {agent: devin, model: swe-2-max}
+    - {agent: codex, model: gpt-6.1-sol, effort: medium}
+  low:
+    - {agent: devin, model: swe-2-max}
+    - {agent: codex, model: gpt-6-luna, effort: low}
+  imagegen:
+    - {agent: codex, model: gpt-6.1-sol, effort: high}
+# Highest first: a provider with no frontier member takes its member of the first tier that has one.
+tierOrder: [frontier, high, medium, low]
+# Seat -> tier. A seat is a long-lived agent role; an op takes the tier of its difficulty.
+seats:
+  supervisor: frontier
+  planner: frontier
+  validator: frontier
+  kernelManager: frontier
+  kernel: high
+  worker: high
+# The kernel's own model calls (selection.yaml kernelFunctionKinds) take the tier of their seat.
+kindSeats:
+  model.assessGoal: planner
+  model.planOp: planner
+  model.decide: kernelManager
+  model.manageWorkflow: kernelManager
+  model.validateOp: validator
+  model.critiqueGoal: validator
+  model.classifyScreen: kernelManager
+  model.presentOwnerQuestion: kernelManager
+  judge: validator
+difficulty:
+  insane: frontier
+  hard: high
+  medium: medium
+  easy: low
+# A kind named here takes that tier whatever its difficulty; the drawing ops take the tier of their difficulty like every core op.
+kindTiers: {}
+# A tier no seat and no op takes: only a headless call made by one op is made on it (`calls`). A tier not named here is a seat tier.
+tierUse:
+  imagegen: call
+# Headless calls: the call tier whose chain the call is picked from (the same picker: hard filter, bias, balance, token use),
+# the longest one call may run, and the most images and reference images it takes.
+calls:
+  imagegen: {tier: imagegen, timeoutMs: 600000, maxImages: 8, maxReferences: 6}
+# Balance over the recent picks of one tier, running seats included.
+balance:
+  maxStreak: 3
+  maxSharePercent: 70
+# Token use of the chosen member, in percent of its most used quota window. Automatic picks skip a member at
+# `reservePercent`; an owner bias naming the member keeps it usable up to `biasPercent`; `exhaustedPercent` is never used.
+usage:
+  reservePercent: 90
+  biasPercent: 95
+  exhaustedPercent: 100

package/runtime/scripts/api/fs/claim-file.mjs

@@ -0,0 +1,30 @@
+// claim-file.mjs — an exclusive writer claim on one file: a lock file beside it names the claiming process, so two processes never rewrite the same file at once
+// (the sealed secret writer, scripts/hfs/secret.mjs). The claim of a process that no longer exists is replaced.
+import fs from 'node:fs';
+import path from 'node:path';
+import { pidAlive } from '../../lib/pid-alive.mjs';
+
+const UNREADABLE_HELD_MS = 10_000;
+const holderOf = (lock) => {
+  try { const pid = JSON.parse(fs.readFileSync(lock, 'utf8')).pid; return Number.isInteger(pid) ? pid : null; } catch { return null; }
+};
+/** A lock a claimant created but has not yet written is held for a moment: only an old unreadable lock is a crashed claim. */
+const freshlyCreated = (lock) => { try { return Date.now() - fs.statSync(lock).mtimeMs < UNREADABLE_HELD_MS; } catch { return false; } };
+
+/** {ok: true, release} once this process holds the claim of `file`; {ok: false, holder} while a live process (this one included) holds it. `pid` is the claiming process. */
+export function claimFile(file, { pid = process.pid } = {}) {
+  const lock = path.join(path.dirname(file), `.${path.basename(file)}.lock`);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      fs.writeFileSync(lock, JSON.stringify({ pid }), { flag: 'wx', mode: 0o600 });
+      return { ok: true, release: () => { if (holderOf(lock) === pid) fs.rmSync(lock, { force: true }); } };
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+      const holder = holderOf(lock);
+      if (holder !== null ? pidAlive(holder) : freshlyCreated(lock)) return { ok: false, holder };
+      fs.rmSync(lock, { force: true });
+    }
+  }
+  return { ok: false, holder: null };
+}

package/runtime/scripts/api/fs/ensure-temp-root.mjs

@@ -0,0 +1,27 @@
+// ensure-temp-root.mjs — the temp root exists and takes writes before anything is placed in it or a child is started with TEMP/TMP/TMPDIR pointing at it.
+import fs from 'node:fs';
+import path from 'node:path';
+import { tempRoot, TEMP_ROOT_ENV } from '../../../engine/temp-root.mjs';
+
+const TEMP_ROOT_UNUSABLE = 'TEMP_ROOT_UNUSABLE';
+const writable = new Set();
+
+const unusable = (root, reason) => Object.assign(new Error(`${TEMP_ROOT_UNUSABLE}: the temp root ${root} ${reason}; set roots.temp in config.yaml (or ${TEMP_ROOT_ENV}) to a directory the runtime can create and write - it is not replaced by the operating-system temp directory`), { code: TEMP_ROOT_UNUSABLE, root });
+
+/** Writes and removes one probe file in `root`: a directory that exists can still refuse writes. */
+function probeWritable(root) {
+  const probe = path.join(root, `.starci-write-probe-${process.pid}`);
+  fs.writeFileSync(probe, '');
+  fs.rmSync(probe, { force: true });
+}
+
+/** The temp root of `env`, created when it is missing. Throws an Error with code TEMP_ROOT_UNUSABLE when it cannot be created or written. */
+export function ensureTempRoot({ env = process.env } = {}) {
+  const root = tempRoot({ env });
+  try {
+    fs.mkdirSync(root, { recursive: true });
+    if (!writable.has(root)) probeWritable(root);
+  } catch (error) { throw unusable(root, `cannot be created or written (${error.code ?? error.message})`); }
+  writable.add(root);
+  return root;
+}