@starci/hfs 4.0.10 → 4.2.0

package/runtime/modules/models/runtimes.yaml

@@ -2,20 +2,14 @@ schema: starci/runtimes@1
 purpose: |-
   Every runtime is a provider-window pool with real parallel slots and a cooldown: the pool boundary IS the
   quota-window boundary, so one pool never spans two independently metered windows and one window never splits
-  into two pools. The workflow-bound profile applies adaptive capacity from config.yaml: role, tier, tools,
-  qualification, independent review, fresh provider quota, shared admitted load and recent observed service
-  filter and score provider families before one runtime is handed to the typed launcher. The preference/tier
-  lists below are within-family suitability and a compatibility policy for direct low-level consumers; they are
-  not a provider fallback chain in a workflow. A runtime that fails is classified and parked for the cooldown of
-  that failure kind, doubling per repeat. Auth health is provider-wide rather than pool-wide: a confirmed
-  launch, worker-start or attestation auth rejection parks every runtime sharing that provider credential. A
-  stale-token preflight may make one real refresh attempt; a typed no-effect rejection falls through on the
-  same logical operation attempt, while partial or unknown effects require reconciliation before fallback.
-
-  Models are pinned inside the pool per DIFFICULTY (`models`) and attested at launch - never inferred from the
-  pool name. The pools themselves — membership, `provider`, `roles`, `maxParallel`, per-difficulty `models`
-  and `effort` pins, `defaultModel` — live in modules/models/registry.yaml `pools`, the ONE model catalog;
-  this file keeps only the operational allocation policy and runtime tuning that is not model data.
+  into two pools. Which model takes which work is modules/models/tiers.yaml; the pools themselves live in
+  modules/models/registry.yaml `pools`. This file keeps the operational allocation policy and runtime tuning that is
+  not model data. A runtime that fails is classified and parked for the cooldown of that failure kind, doubling per
+  repeat and capped (cooldownMs, circuitBackoff, maxCooldownMs: every park is time-bounded and expires by itself).
+  Auth health is provider-wide rather than pool-wide: a confirmed launch, worker-start or attestation auth rejection
+  parks every runtime sharing that provider credential. A stale provider token is not admitted (the owner
+  re-authenticates in Orca); a typed no-effect rejection falls through on the same logical operation attempt, while
+  partial or unknown effects require reconciliation before fallback.
 # `maxParallelOps` is the worker-wide ceiling across every workflow; `budgets.maxOps` in the owner's
 # config.yaml is the per-workflow one. The lower of the two admits: engine/admission.mjs
 # opSlotCeiling takes min(budgets.maxOps, maxParallelOps) and scripts/kernel/cli.mjs refuses
@@ -26,181 +20,21 @@ allocation:
   admission:
     schema: starci/agent-admission-policy@1
     version: 1
-    reservePercent: 90
-    exhaustedPercent: 100
+    # Age limit of evidence the runtime observes itself at admission time: owner grants and direct probes (Devin).
     maxAgeMs: 300000
+    # Age limit of provider windows the host polls (Orca account entries). Orca refreshes usage while its window is
+    # focused and after agent sessions end; the runtime cannot request a refresh. A launch against an exhausted window
+    # is refused by the provider and classified by the provider circuit. Never below maxAgeMs.
+    hostPolledMaxAgeMs: 86400000
     qualityOrder: [economy, standard, frontier]
-    ownerBiasRoles: [op]
+    ownerBiasRoles: [op, kernel, supervisor, worker, critic]
     eligibilityModes: [qualified, probation, kernel-function, scoped-control-plane, operation-policy]
     roles:
       kernel: {qualityFloor: standard}
-      op:
-        qualityFloor: economy
-        difficultyFloors: {easy: economy, medium: economy, hard: frontier, insane: frontier}
+      op: {qualityFloor: economy}
       supervisor: {qualityFloor: standard}
       worker: {qualityFloor: standard}
       critic: {qualityFloor: standard, independence: provider}
-  # The default policy. config.yaml allocation.policy overrides it for `starci kernel route` (engine/config.mjs
-  # configuredAllocationPolicy): prefer-then-overflow takes the first eligible pool of the tier order below;
-  # balanced walks the eligible pools of that order and takes the FIRST one still below its config.yaml
-  # allocation.shares target of the recent dispatches (scripts/agent/balance.mjs counts them; scripts/agent/
-  # models.mjs selectPool picks), so the evidence order ranks and the share caps; when every eligible pool
-  # is at or above its share, the one furthest below (least over) takes it and the order breaks ties. Under
-  # both, every gate (role, difficulty pin, owner grant, host tools, quota/auth, circuit, maxParallel)
-  # applies first.
-  policy: prefer-then-overflow
-  # Under balanced, a pool listed here for a work class and tier is taken only when no other pool of the
-  # order is eligible: Opus stays hands-on overflow below insane, so its share is spent on think work; at
-  # insane, where only Opus and Sol pin a model, the two balance.
-  balanced:
-    overflowOnly:
-      hands-on:
-        easy: [claude-agent]
-        medium: [claude-agent]
-        hard: [claude-agent]
-  # Owner decision 2026-09-25 (review-hands, amending routing-by-evidence): a pool an order lists here is taken
-  # only when no other pool of that order is eligible, under EITHER policy - neither the balanced share nor the
-  # owner's goal routing_bias prefer moves it ahead. Opus and Sol are the review order's overflow: they take a review only when
-  # Devin is unavailable (circuit open, quota dead, full, or excluded by the cross-family rule).
-  overflowByOrder:
-    review: [claude-agent, codex-agent]
-  # Cross-family audit: a verify kind whose records overlap the output of the latest settled non-verify op of
-  # the workflow (scripts/kernel/cli.mjs cmdRoute finds that author with scripts/agent/balance.mjs
-  # auditAuthorOf) routes to an eligible pool of another audit family - the reviewer's provider differs from
-  # the implementer's. The audit families are the pools of `frontier` and `hands`: Opus or Sol review what
-  # Devin implemented; Sol reviews Opus's records and Opus reviews Sol's. The author's
-  # own family is taken only when no pool of another family is eligible (crossFamily.applied false).
-  # thinkAuditCrossFamily keeps its name from when only think verdicts were audited.
-  thinkAuditCrossFamily: true
-  # The frontier think group: Claude Opus 5.5 and GPT-6.1 Sol. It is what the kernel's own model calls route
-  # over (scripts/route/route-model.mjs decisionFlow kernel-function) and two families of the cross-family
-  # audit above.
-  frontier: [claude-agent, codex-agent]
-  # The hands group: Devin (SWE-2 Max). It implements and, since the owner decision of 2026-09-25
-  # (review-hands), reviews - the third audit family.
-  hands: [devin-agent]
-  # Owner decision 2026-09-25 ("ok"): route by the 72h evidence of scripts/agent/model-scorecard.mjs (1389 op jobs over the product ledgers of that window).
-  # Those historical Sol scores describe the pre-migration model; they are not GPT-6.1 Sol qualification evidence.
-  # Each kind walks ONE order, named by its roleOfKind `order` (default: `think` for think work, else its role),
-  # at its difficulty tier:
-  #   implement, write, verify (hands-on implementation: backend.implement, interface.implement, code.refactor,
-  #     test.author, the hands-on verify kinds, release/scope finish): Devin first, then Codex and Claude -
-  #     Devin passed 70% of backend.implement and 68% of interface.implement over the 72h scorecard.
-  #   scaffold (scaffold, docs, content, grammar.update - small work - and every cut slice of a fan-out, which
-  #     scripts/kernel/cli.mjs cmdRoute routes on this order): Devin first - backend.scaffold passed 73% on Devin,
-  #     43% on Codex over the 72h scorecard.
-  #   think, decide, plan (every think kind: decide, review and author ops): Claude Opus first, GPT-6.1 Sol second
-  #     and nothing else - Opus passed 72-73% of business/architecture.decide, Sol 60-64%. Think kinds route at a hard floor, where codex-agent pins Sol; the
-  #     easy and medium keys (Claude only, never Luna) exist for direct role consumers that bring no kind.
-  #   draw (interface.draw; owner ruling 2026-09-27 draw-devin-brand-claude, modules/kernel/owner-rulings.yaml):
-  #     Devin draws first (SWE-2 Max; token-render HTML + Playwright in the product checkout - its card carries
-  #     browser-dom), Codex (GPT-6.1 Sol at effort high) is the fallback. The raster regions a drawing needs are
-  #     artworkSlots for interface.asset, never painted by the drawer. Devin pins no easy or insane model, so the easy
-  #     and insane keys are Codex alone. The draw loop's independent critic stays a DIFFERENT model from the drawer
-  #     (allocation.drawLoop.critic, criticWhenDrawer).
-  #   asset (interface.asset): Codex only - the one agent with the image tool (image_gen.imagegen).
-  #   brand (brand.decide; owner ruling 2026-09-27 draw-devin-brand-claude): Claude Opus decides the brand and its
-  #     direction, GPT-6.1 Sol is the fallback when the Claude pool cannot serve; Codex is also the cross-family second
-  #     opinion on think work.
-  #   review (owner decision 2026-09-25 review-hands, amending the think order above: "codex/claude only
-  #     decide (that is, set the strategy), review must be done by the hands"): every verify kind -
-  #     review.verify, handover.review, security.verify, goal.validate, uat.assisted.verify, interface.audit and
-  #     the hands-on e2e/integration/perf/uat verify kinds - and work.author walk the review order: Devin,
-  #     then Opus and Sol as overflow only (overflowByOrder.review). The cross-family rule sends a review of
-  #     what Devin implemented to Opus or Sol. An experiment, measured in
-  #     benchmark/findings/2026-09-25-review-hands.md.
-  # Claude and Codex keep strategy: request.analyze, scope.define, business/architecture/goal decide and
-  # revise, decision.prepare and implementation.plan (the cut) stay on think/decide/plan (Opus, Sol); brand.decide
-  # walks its own brand order (Opus, then Sol).
-  # interface.audit needs the browser-dom host tool: Devin and Codex carry it, Claude does not, so the
-  # host-tool gate passes Claude over (Devin audited it at 11% pass, 83% fail over the 72h scorecard -
-  # the experiment re-measures it).
-  # Devin (SWE-2-max) pins no easy or insane model, so easy hands-on work starts at Codex (Luna) and insane
-  # hands-on work at the frontier pools; Opus stays hands-on overflow below insane.
-  # Owner routing 2026-09-26: Opus brainstorms and decides (think/decide/plan orders); Sol draws, audits the UI
-  # and verifies e2e/security/assisted UAT (order ui: Devin as fallback when the Codex quota circuit
-  # opens); Devin implements, run the kernel and do the mechanical ops (provision.ask, workspace.manage,
-  # task.execute, knowledge.repair walk implement); the kernel's own model calls walk sol-think (Sol, Opus overflow).
-  tiers:
-    hard:
-      default: [devin-agent, codex-agent, claude-agent]
-      implement: [devin-agent, codex-agent, claude-agent]
-      write: [devin-agent, codex-agent, claude-agent]
-      verify: [devin-agent, codex-agent, claude-agent]
-      scaffold: [devin-agent, codex-agent, claude-agent]
-      think: [claude-agent, codex-agent]
-      decide: [claude-agent, codex-agent]
-      plan: [claude-agent, codex-agent]
-      draw: [devin-agent, codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [devin-agent, claude-agent, codex-agent]
-      ui: [codex-agent, devin-agent]
-      sol-think: [codex-agent, claude-agent]
-    medium:
-      default: [devin-agent, codex-agent, claude-agent]
-      implement: [devin-agent, codex-agent, claude-agent]
-      write: [devin-agent, codex-agent, claude-agent]
-      verify: [devin-agent, codex-agent, claude-agent]
-      scaffold: [devin-agent, codex-agent, claude-agent]
-      think: [claude-agent]
-      decide: [claude-agent]
-      plan: [claude-agent]
-      draw: [devin-agent, codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [devin-agent, claude-agent, codex-agent]
-      ui: [codex-agent, devin-agent]
-      sol-think: [codex-agent, claude-agent]
-    easy:
-      default: [codex-agent, claude-agent]
-      implement: [codex-agent, claude-agent]
-      write: [codex-agent, claude-agent]
-      verify: [codex-agent, claude-agent]
-      scaffold: [codex-agent, claude-agent]
-      think: [claude-agent]
-      decide: [claude-agent]
-      plan: [claude-agent]
-      draw: [codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [claude-agent, codex-agent]
-      ui: [codex-agent]
-      sol-think: [codex-agent, claude-agent]
-    # Insane tops the ladder: only pools that declare an insane model can serve it. Devin carries no insane
-    # pin and is ineligible here by the models gate, so it is absent rather than listed-and-rejected (an insane
-    # review is Opus's, with Sol as overflow).
-    insane:
-      default: [claude-agent, codex-agent]
-      implement: [claude-agent, codex-agent]
-      write: [claude-agent, codex-agent]
-      verify: [claude-agent, codex-agent]
-      scaffold: [claude-agent, codex-agent]
-      think: [claude-agent, codex-agent]
-      decide: [claude-agent, codex-agent]
-      plan: [claude-agent, codex-agent]
-      draw: [codex-agent]
-      asset: [codex-agent]
-      brand: [claude-agent, codex-agent]
-      review: [claude-agent, codex-agent]
-      ui: [codex-agent]
-      sol-think: [codex-agent, claude-agent]
-  # config.yaml allocation.preferredProvider is a bias within the tier's eligible pools and never moves think
-  # work to a pool outside `think` (scripts/route/route-model.mjs).
-  preference:
-    implement: [devin-agent, codex-agent, claude-agent]
-    verify: [devin-agent, codex-agent, claude-agent]
-    write: [devin-agent, codex-agent, claude-agent]
-    scaffold: [devin-agent, codex-agent, claude-agent]
-    think: [claude-agent, codex-agent]
-    decide: [claude-agent, codex-agent]
-    plan: [claude-agent, codex-agent]
-    draw: [devin-agent, codex-agent]
-    asset: [codex-agent]
-    brand: [claude-agent, codex-agent]
-    review: [devin-agent, claude-agent, codex-agent]
-    ui: [codex-agent, devin-agent]
-    sol-think: [codex-agent, claude-agent]
   # Heavy work fans out: a big node is cut into children with disjoint write scopes, the seam every other child
   # would touch is built first and alone, then the rest run at once - bounded here so one parent never takes
   # every slot of the pool and leaves the rest of the tree waiting behind it.
@@ -212,10 +46,8 @@ allocation:
   # bounds in kinds.yaml (12 files / 8 assertions / 3 components) are a coarse screen over the same
   # measure — the estimate is the authority. When N > 1 slices are admitted together the kernel
   # routes them one after the other with plain starci kernel route (a Kernel --prefer/--avoid is ignored, owner
-  # decision 2026-09-25) so the workers spread over the lanes instead of piling onto the first pool. A
-  # hands-on slice (payload.cut) walks the scaffold order, Devin first (owner decision 2026-09-25): each
-  # routed slice is already counted before the next one is routed, and a pool that reaches its share
-  # passes the next slice down the order.
+  # decision 2026-09-25) so the workers spread over the lanes instead of piling onto the first pool. Each
+  # routed slice is recorded as a pick before the next one is routed, so the balance step spreads the slices.
   # A gear never raises a pool's maxParallel, maxParallelOps or budgets.maxOps: it raises only what
   # `starci kernel estimate` requests, and admission still clamps it.
   slicing:
@@ -228,8 +60,7 @@ allocation:
     # `l.from.files: 12` is ledger-derived: of 52 settled implement/refactor/author jobs in the
     # measured product ledger, closures at or above 12 authored files ran a median 46 min against 12 min below
     # it, the first cutoff where the majority exceeds one targetMinutes[1] window
-    # (benchmark/findings/2026-09-23-parallel-gear.md). Every other `from` bound is the
-    # benchmark/findings/fable.md sketch value carried as an ASSUMPTION: that ledger holds exactly one job over three
+    #. Every other `from` bound is a sketch value carried as an ASSUMPTION: that ledger holds exactly one job over three
     # windows and no assertion or component measurement at all, so `xl.from` and both `assertions`
     # bounds have no observation behind them and are re-derived when estimate inputs are recorded.
     size:
@@ -240,6 +71,9 @@ allocation:
   # and nowhere else.
   dispatchLeaseTtlMs: 1800000
   watchdogCadenceMs: 300000
+  # usageEveryMs: the token meter's sweep interval (host controller duty host/usage, scripts/kernel/usage-record.mjs). An attempt that ended less
+  # than this ago is still being metered: the autopilot budget does not count its missing usage as unknown (scripts/kernel/autopilot-budget.mjs).
+  usageEveryMs: 300000
   observeCadenceMs: 180000
   # activeStaleMs: an `active` screen (spinner/"Working" row) is trusted only while the terminal still
   # prints; a spinner re-renders every second, so output older than this is a frozen frame. The watchdog
@@ -259,9 +93,20 @@ allocation:
   # the decision doorbell; still the same turn turnInterruptGraceMs later, the seat is replaced (KERNEL_TURN_OVERDUE,
   # scripts/reconciler/controllers/host.mjs turnStep). A busy turn defers every doorbell and notice (kernel-busy).
   liveness: {activeUnclassifiedMs: 120000, activeStaleMs: 600000, quietMs: 1200000, launchGraceMs: 90000,
-    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000}
+    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000,
+    # The watchdog's replacement of a Kernel seat runs start-workflow (worktree check, install, Orca launch, attestation): bounded here, under the Host controller's
+    # seats.kernel.timeoutMs that kills the whole watchdog pass. A start that outlives it is killed and recorded kernel-start-failed (start-timeout), never lost silently.
+    kernelStartTimeoutMs: 600000}
   # one local git read over a job's owned paths (scripts/kernel/owned-path-effects.mjs ownedPathEffects, job-artifacts.mjs).
   settleGit: {commandMs: 15000}
+  # prompt-file.mjs owns terminal delivery, wake bounds, file placement and cleanup.
+  promptFile: {maxChars: 2000, ttlMs: 86400000}
+  # opVerbs: the bound of the "your verbs" block of an [Op] prompt (scripts/kernel/op-prompt-verbs.mjs): the starci calls the op's contract names,
+  # each with the flags the contract uses and the required ones, one line per verb. A worker that has the exact call never runs --help
+  # (a measured op spent 15 of its 135 turns on it). `standing` verbs are printed in full by the prompt's own reporting and logging blocks;
+  # `omitGroups` are the verbs of the Kernel and above, which an op's contract names only to say who runs them.
+  opVerbs: {maxVerbs: 20, maxChars: 3000, lineChars: 190, standing: ["kernel report", "kernel log", "kernel op-contract"],
+    omitGroups: [kernel, supervisor, workflow, reconciler]}
   # Typed logs (scripts/kernel/typed-logs.mjs, the ledger's logs table): perJobCap rows a job's own writes
   # may store before one log.truncated row closes them (derived event rows are never capped); dataMaxBytes bounds
   # one row's data after redaction. diff: the caps of a job patch's pre-structured <patch>.json
@@ -275,9 +120,8 @@ allocation:
   # start waits for an Orca that does not answer, and how long after a responding Orca calls a kernel dead
   # it is asked again.
   hostOutage: {waitMs: 90000, deathSettleMs: 10000}
-  # supervisorTick: the numbers of the retired supervisor tick (2026-09-28) that the reconciler controllers still read
-  # (host thresholds, orca probes, statusApp port, owner digest cadence); everyMs is unused. The tick ran every
-  # everyMs (whole minutes: schtasks repetition). host: above maxNode node.exe or maxGit git.exe processes the host
+  # supervisorTick: the numbers the reconciler controllers read
+  # (host thresholds, orca probes, statusApp port, owner digest cadence). host: above maxNode node.exe or maxGit git.exe processes the host
   # controller logs the counts and the parents holding the most. orca: terminal-list is probed up to probes times, probeTimeoutMs each, gapMs apart; when every
   # probe fails the Orca app (never its terminal daemon) gets closeWaitMs to close before it is forced, is launched
   # again, and restart-all runs. deadKernelMs: a watchdog whose trailing ticks read tick-failed or restart-failed
@@ -290,7 +134,6 @@ allocation:
   # actions.mjs) no supervisor action touched this long is an SLA breach, alerted into the Supervisor's inbox.
   # ownerDigestMs: the Owner Notifier's periodic owner digest goes out at most this often.
   supervisorTick:
-    everyMs: 1800000
     host: {maxNode: 300, maxGit: 100}
     orca: {probeTimeoutMs: 30000, probes: 5, gapMs: 30000, closeWaitMs: 20000}
     deadKernelMs: 900000
@@ -344,16 +187,24 @@ allocation:
     releaseWindowMs: 86400000
     tail: {retryMs: 120000, maxAttempts: 5}
   # redesign (starci kernel redesign; owner 2026-09-28: heavy redesign is dispatched to the op that owns it, and the Kernel stays on
-  # Devin): these ops, enqueued from an RCA, route as `routeAs` (implementation.plan: the plan order - Opus, then Sol) at
-  # >= minDifficulty at `effort` whatever their usual order (work.author walks the review order, Devin first, otherwise).
+  # Devin): these ops, enqueued from an RCA, route as `routeAs` (implementation.plan) at
+  # >= minDifficulty at `effort`.
   redesign:
     ops: [work.author, scope.define, goal.revise]
     routeAs: implementation.plan
     minDifficulty: hard
     effort: high
   # selfReload (scripts/machine/self-reload.mjs): a watchdog loop re-execs at most once per minIntervalMs; its
-  # replacement takes over the loop's lock within handoverMs or is stopped.
-  selfReload: {minIntervalMs: 300000, handoverMs: 30000}
+  # replacement takes over the loop's lock within handoverMs or is stopped. The reconciler engine checks every checkMs; an engine whose
+  # revision still differs from the live one that long past minIntervalMs + checkMs + handoverMs is a drift row (scripts/reconciler/drift.mjs).
+  selfReload: {minIntervalMs: 300000, handoverMs: 30000, checkMs: 60000, driftGraceMs: 120000}
+  # deploy (scripts/reconciler/runtime-deploy.mjs): a deploy waits up to waitMs, polling every pollMs, for the settles, Critic runs and prepared
+  # decisions in flight to finish; after the engine restart it waits up to verifyMs for the new leader's fresh heartbeat on the new revision. The affected-spec child
+  # may run its declared budget (modules/supervisor/affected-tests.yaml) plus affectedMarginMs before the deploy stops it.
+  deploy: {waitMs: 1800000, pollMs: 5000, verifyMs: 120000, affectedMarginMs: 300000}
+  # dispatchRefusal (scripts/kernel/dispatch-refusal-memo.mjs): a ready job whose dispatch is refused for the same cause is tried again after baseMs, then twice as long each time (the one retry budget), up to capMs; a change of
+  # the cause's fingerprint (runtime revision, a ruling, a resource the refusal names) tries it at once.
+  dispatchRefusal: {baseMs: 60000, capMs: 900000}
   # footprint (scripts/guards/footprint-scan.mjs): one host-wide scan at most every everyMs; a crashed
   # tick's claim lock is cleared after lockStaleMs.
   footprint: {everyMs: 600000, lockStaleMs: 60000}
@@ -361,11 +212,24 @@ allocation:
   jobGuard: {ttlMs: 604800000}
   # landGate (scripts/supervisor/land.mjs): a land waits waitMs for its turn at the gate; its spec run may take
   # specsBaseMs plus perSpecMs for every spec it runs, specConcurrency spec files at a time.
-  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6}
+  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6, cliVerbs: 12}
   # workerClose (scripts/machine/worker-close.mjs; owner rule: a finished worker is closed COMPLETELY): after worker-release and the terminal
   # close the runtime waits verifyMs for every process of that terminal's shell tree to end (polled every pollMs); a survivor proven to belong
   # to the tree is stopped and given stopVerifyMs to end before the finding is raised.
-  workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000}
+  # A finished [Worker] job whose terminal has no recorded closure is closed again by the Job controller's worker sweep (scripts/supervisor/supervisor-watchdog.mjs):
+  # every leftoverRetryMs (doubling to leftoverRetryMaxMs) for at most leftoverRetryAttempts attempts, each failure recorded with its reason on the job.
+  # uatSlot (scripts/uat/slot-collect.mjs, slot-lessee.mjs): a held UAT run checks its lessee (its attempt, the process that launched it) every watchMs and ends with it;
+  # the Host pass ends a slot whose lessee is gone, and a slot that recorded no lessee at all once it has been held unknownHoldMs (3 hours: a UAT run is minutes).
+  uatSlot: {watchMs: 5000, unknownHoldMs: 10800000}
+  workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000, leftoverRetryMs: 60000, leftoverRetryMaxMs: 900000, leftoverRetryAttempts: 12}
+  # providerReservation (scripts/machine/provider-reservation-reap.mjs): an admission whose receipt stayed `reserved` this long never reached
+  # worker-start (the consume moves it to `launching` first), so its launcher died and the slot is released. A receipt with no terminal handle and no
+  # process is released once the host restarted after its last update (scripts/machine/provider-reservation-restart.mjs); restartToleranceMs is the
+  # margin the restart instant must clear that update by. A handle-less receipt no proof reaches opens the PROVIDER_RESERVATION_HELD clock after unknownHeldMs.
+  providerReservation: {reservedStaleMs: 900000, unknownHeldMs: 1800000, restartToleranceMs: 5000}
+  # hostLock (scripts/machine/verb-lock.mjs): a verb that finds the host lock held (npm ci, npm install) retries on the retry budget
+  # of scripts/lib/retry-budget.mjs (the interval doubles to retryMaxIntervalMs) until retryDeadlineMs, then refuses with every attempt named.
+  hostLock: {retryIntervalMs: 5000, retryMaxIntervalMs: 30000, retryDeadlineMs: 180000}
   # waiterPriority (scripts/kernel/waiter-priority.mjs): a queued job that has blocked another
   # workflow this long earns its Kernel one heads-up per newly waiting workflow.
   waiterPriority: {blockingHeadsUpMs: 900000}
@@ -395,19 +259,26 @@ allocation:
   quitAgent: {waitMs: 6000}
   # drawRender (scripts/work/draw-render.mjs): a capture waits settleMs after document.fonts.ready.
   drawRender: {settleMs: 500}
+  # layoutRender (scripts/work/layout-render.mjs): the runtime serves the product app for one capture; readyMs is how long the dev server may take to answer
+  # its first request (a cold Next compile), navigateMs the page load, settleMs the wait after fonts are ready, stopMs the grace before a still-running server is killed.
+  # publicOriginKeys are the scaffold's public-origin variables (its README: the product app's own address and the product app the landing hands over to); each gets the render's origin.
+  layoutRender: {readyMs: 180000, navigateMs: 90000, settleMs: 500, stopMs: 5000, publicOriginKeys: [NEXT_PUBLIC_SITE_URL, NEXT_PUBLIC_APP_URL]}
   # drawLoop (scripts/work/draw-loop.mjs, scripts/work/draw/draw-taste.mjs; owner rulings 2026-09-27): interface.draw
   # draws -> shoots -> evaluates -> fixes in rounds. A loop stops when every machine metric passes and the
   # independent critic's beauty is at least beautyMin, after maxRounds, or after stallRounds rounds in a row that
   # neither cut the failures nor raised the beauty; the best round is kept. Taste thresholds: accentBudget is the
   # largest share of the render the accent colour may fill (the brand art band excluded), bandsPerCardMax the most
   # hairline bands one card splits into, badgesPerEntityMax the most badges one entity carries. critic is the fresh,
-  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: started
+  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: picked through
+  # the tier picker from the Critic tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with the
+  # independence rule as a hard filter, then started
   # through orchestration worker-start --agent <provider> --model --effort (scripts/agent/lib.mjs startAgent) on a
   # runtime worktree detached at the empty tree (draw-critic.mjs criticWorkspace; Orca refuses a bare temp dir) holding only the PNGs, the HTML and the rubric; it writes verdict.json and reports worker_done; a
-  # critic with no worker_done within timeoutMs is stopped and released (outcome timeout, no beauty). The critic is a DIFFERENT model from the drawer (owner ruling 2026-09-27
-  # draw-devin-brand-claude): Devin draws, Codex critiques; when the drawer (the op's provider, bound to its
-  # terminal - scripts/guards/op-context.mjs - or draw-loop.mjs round --drawer) is the critic's provider - Codex drawing as the draw order's fallback - the round is
-  # judged by criticWhenDrawer.<drawer> instead, and a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
+  # critic with no worker_done within criticTimeoutMs is stopped and released (outcome timeout, no beauty). The critic is a member of ANOTHER PROVIDER than
+  # the drawer: the members of its tier of that provider are removed before the pick, and a tier with no other provider's member refuses the critique with
+  # CRITIC_NO_INDEPENDENT_MEMBER (the drawer never judges itself). The images a drawer asks of the imagegen call
+  # (starci work imagegen) do not make the call's model the drawer. The drawer is the op's provider, bound to its
+  # terminal (scripts/guards/op-context.mjs) or named by draw-loop.mjs round --drawer; a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
   # archetype for its ui record's ui.archetype - brand.mjs checkDirection evidence.ready, the owner's receipt
   # (scripts/kernel/prerequisites.mjs direction-unaccepted; the Kernel enqueues brand.decide --param
   # directionArchetype=<archetype> first). false switches the gate off.
@@ -418,9 +289,7 @@ allocation:
     accentBudget: 0.10
     bandsPerCardMax: 3
     badgesPerEntityMax: 2
-    critic: {provider: codex, model: gpt-6.1-sol, effort: high, timeoutMs: 900000}
-    criticWhenDrawer:
-      codex: {provider: claude, model: claude-opus-5-5, effort: high, timeoutMs: 900000}
+    criticTimeoutMs: 900000
     directionPrerequisite: true
     # How long the workflow that claimed foundation `shell` (the layout chain an interface.draw draws) may hold it before a
     # waiting draw opens a Supervisor Decision Item (scripts/kernel/shell-foundation.mjs; owner ruling 2026-09-29 draw-from-todo).
@@ -439,7 +308,8 @@ allocation:
   #     need it wait for the one end-of-flow credential checklist (provision.ask subject handover-credentials);
   #   - a retry cap or an owner-gate that is really a runtime/process issue is a supervisor-gate incident (the
   #     Supervisor fixes or decides the retry), supervisorExtraBudget gates per node group, then the leg is
-  #     deferred; an unresolved supervisor-gate older than supervisorGateTimeoutMs defers what it holds;
+  #     deferred; an unresolved supervisor-gate older than supervisorGateTimeoutMs defers what it holds once the owner was told
+  #     (its Supervisor item reached the owner level: modules/kernel/op-incident-policy.yaml gate.deferAfter);
   #   - budgets caps one workflow (non-kernel jobs, token total recorded on jobs, wall time since start): past
   #     one, a supervisor-gate holds new dispatch until the Supervisor extends the budget.
   autopilot:
@@ -458,8 +328,8 @@ allocation:
   # reportWindowMs.
   workerJobs: {leaseTtlMs: 604800000, reportWindowMs: 604800000}
   # draft (scripts/kernel/clear-draft.mjs): the beat between one Ctrl+U and the re-read that judges
-  # the input box's answer - a TUI repaints a beat later. clearDraft and probeDraft default to it and
-  # the wake-delivery draft probe caps its own interval at it.
+  # the input box's answer - a TUI repaints a beat later. clearDraft defaults to it and
+  # wake-delivery caps its runtime-owned draft clear interval at it.
   draft: {intervalMs: 300}
   # housekeeping (scripts/housekeeping/housekeeping.mjs): every retention window and root the host
   # cleanup reads - no literal may live in the script. tmp: top-level %TEMP% entries whose name starts
@@ -472,7 +342,7 @@ allocation:
   # archiveMaxAgeMs are deleted outright. lanesRoot is where lane worktrees sit; a landed lane is
   # removed only once its branch reflog, HEAD reflog and directory stayed unchanged for laneGraceMs
   # (a fresh lane with no commit yet reads as landed to git cherry); unset, no lane is removed.
-  # logMaxAgeMs caps every jsonl and log under %LOCALAPPDATA%/StarCi and ~/.starci.
+  # logMaxAgeMs caps every jsonl and log under the state base (<runtime root>/.runtime) and ~/.starci.
   # gitIndexLockStaleMs: a product checkout's .git/index.lock older than this, with no git process on
   # that repository (one naming no repository counts as on it), is removed by
   # scripts/api/git/index-lock.mjs - from the op worker's git shim before git runs, and by the
@@ -488,12 +358,16 @@ allocation:
       work-acceptance-, work-brand-test-, work-core-test-, work-custody-test-, work-external-,
       work-index-md-, work-module-spec-, example-critique-, example-derive-, example-evidence-, example-verify-,
       example-work-gate-, work-artifacts-, work-consistency-, work-surfaces-,
-      grammar-land-, kernel-replace-close-, nm-link-, rc-job-, rc-health-, release-gate-, seat-titles-, slice-typecheck-, unit-roles-, spec-budget-]
+      grammar-land-, kernel-replace-close-, nm-link-, rc-job-, rc-health-, release-gate-, seat-titles-, slice-typecheck-, unit-roles-, spec-budget-,
+      model-hotload-, price-hotload-, owner-trust-, fs-kind-contract-, private-publication-, private-create-, private-lease-, private-partial-,
+      private-unknown-, private-inode-, private-bound-, private-link-, private-prefix-, check-entry-, core-tree-, runtime-public-docs-, blob-publication-,
+      core-debug-schema-, ledger-native-case-, sbx-spec-, runtime-artifact-, gc-archive-proof-, machine-retention-, zip-resource-,
+      core-seat-, core-diag-]
     sessionArchiveAfterMs: 259200000
     claudeTranscriptArchiveAfterMs: 604800000
     archiveMaxAgeMs: 2592000000
     # archiveRoot and lanesRoot are unset on purpose: no host location lives in a tracked file. The defaults are
-    # <starciLocalRoot>/archive and <starciLocalRoot>/lanes (scripts/machine/home.mjs archiveRoot, lanesRoot); the owner
+    # <starciLocalRoot>/archive (<runtime root>/.runtime/archive) and a per-user lanes directory outside the checkout (scripts/machine/home.mjs archiveRoot, lanesRoot); the owner
     # relocates them with STARCI_ARCHIVE_ROOT and STARCI_LANES_ROOT or by setting these keys on the host.
     laneGraceMs: 86400000
     logMaxAgeMs: 1209600000
@@ -519,10 +393,12 @@ allocation:
   # heartbeatStaleMs; one starci kernel status snapshot per workflow is shared for statusCacheMs; a failing key backs off
   # backoff.minMs doubling to backoff.maxMs; more than crashLoop.max engine starts in crashLoop.windowMs start it
   # --safe (read-only) and push the owner one urgent Telegram (boot.mjs).
-  reconciler: {pollMs: 2000, leaseMs: 30000, renewMs: 10000, heartbeatStaleMs: 60000, statusCacheMs: 20000, backoff: {minMs: 1000, maxMs: 300000}, crashLoop: {max: 3, windowMs: 1800000}}
-  # resources: the host-floor guards the provider-health / admission path reads. Below minFreeDiskGb
+  reconciler: {pollMs: 2000, leaseMs: 30000, renewMs: 10000, heartbeatStaleMs: 60000, statusCacheMs: 20000, backoff: {minMs: 1000, maxMs: 300000, maxAttempts: 24}, crashLoop: {max: 3, windowMs: 1800000}, modeDriftMs: 60000}
+  # resources: the host-floor guards the provider-health / admission path reads. These are the shipped defaults; the owner's
+  # config.yaml `resources` (minFreeDiskGb, minFreeDiskPct, minFreeRamPct) overrides them key by key and code holds no number of its own.
+  # Below the disk floor (minFreeDiskGb, or minFreeDiskPct of the drive's size when the owner sets it - the larger applies)
   # `starci kernel dispatch --spawn` refuses host-resources-low until there is room again - measured on the
-  # drive that holds %TEMP% and the repos. RAM goes through the RAM-aware, priority-aware throttle
+  # drives that hold the configured temp root (config.yaml roots.temp, else the OS temp directory) and the repos. RAM goes through the RAM-aware, priority-aware throttle
   # (scripts/machine/ram-throttle.mjs; owner ruling 2026-09-28 "Parallelism ceiling follows real RAM: free RAM below 15%
   # then reduce the number of parallel ops, avoid freezing the machine and killing ops mid-run"): at every dispatch the effective cap
   # is min(maxParallelOps, running + the ops that fit in free RAM above hardFloorPct of total), counted across
@@ -534,7 +410,7 @@ allocation:
   # same way until it falls below cpuHeavyResumeBelow. Running ops are never stopped. Owner ruling 2026-09-28
   # ("15→10, 10→2.5"): the heavy floor 10% resuming at 15%, critical 2.5% resuming at 5%, the fit floor 2.5%.
   resources:
-    minFreeDiskGb: 20
+    minFreeDiskGb: 5
     minFreeRamPct: 10
     ramThrottle:
       heavyResumeAbovePct: 15
@@ -605,9 +481,6 @@ allocation:
   # readiness loop does not starve the pool (scripts/kernel/cli.mjs poolLoadOf, shared by starci kernel route and starci kernel status).
   # Running, leased and answering jobs always hold theirs. Re-routing refreshes the hold.
   routeHoldMs: 900000
-  verifyAvoidsImplementRuntime: true
-  onLaunchFailure: next-available-runtime
-  tieBreak: round-robin
   # worker-start is a managed launch the host refused without classifying it. Two minutes is long
   # enough for the kernel to reroute the attempt to a different pool, short enough that a one-off
   # host hiccup does not park a healthy pool for the rest of the leg. prompt-delivery-stalled is its
@@ -629,67 +502,55 @@ allocation:
 # kinds.yaml role. `work` is `think` when the output is a canonical record (SRS, SDS, scope, goal, decision,
 # brand, ui, Work, workspace, rule) or a verdict about quality, and `hands-on` when the op builds, runs or
 # measures under a record someone else settled. `floor` is the least difficulty the kind routes at:
-# scripts/agent/models.mjs selectPool raises a measured difficulty to it and never lowers one. Every think
-# kind's floor is hard, the tier where every think pool pins a frontier model. The kernel's own model
-# calls (selection.yaml kernelFunctionKinds) are think work at the same floor. `order` names the allocation
-# tiers/preference key the kind walks when it is not the default (`think` for think work, else the role):
-# `scaffold` (Devin first) for scaffold, docs, content and grammar work, `draw` (Devin first, Codex Sol at effort high
-# the fallback) for interface.draw, `asset` (Codex only, the image tool) for interface.asset, `brand` (Opus first, Sol
-# the fallback) for brand.decide, `review` (Devin, Opus and Sol overflow) for the remaining verify kinds and
-# work.author (owner decision 2026-09-25 review-hands), `ui` (Codex first, Devin as fallback) for
-# interface.audit, e2e.verify, security.verify and uat.assisted.verify, `implement` for the mechanical
-# think ops the hands take whatever their kind role - provision.ask, workspace.manage, task.execute and
-# knowledge.repair - and `sol-think` (Sol first, Opus overflow) for the kernel's own model calls, verify
-# calls included (owner routing 2026-09-26). work.author authors Work records - the write role, as in
-# modules/models/kinds.yaml - so the hands pools, which carry no plan role, can take it; its cut form,
-# implementation.plan, stays plan work on the think order.
+# the router raises a measured difficulty to it and never lowers one; the difficulty then names the tier
+# (modules/models/tiers.yaml difficulty), and a kind named under tiers.yaml kindTiers takes that tier instead.
 roleOfKind:
   request.analyze: {role: plan, work: think, floor: hard}
-  task.execute: {role: plan, work: think, floor: hard, order: implement}
+  task.execute: {role: plan, work: think, floor: hard}
   backend.implement: {role: implement, work: hands-on, floor: medium}
-  backend.scaffold: {role: implement, work: hands-on, floor: easy, order: scaffold}
+  backend.scaffold: {role: implement, work: hands-on, floor: easy}
   interface.implement: {role: implement, work: hands-on, floor: medium}
-  interface.audit: {role: verify, work: think, floor: hard, order: ui}
-  interface.scaffold: {role: implement, work: hands-on, floor: easy, order: scaffold}
-  package.scaffold: {role: implement, work: hands-on, floor: easy, order: scaffold}
+  interface.audit: {role: verify, work: think, floor: hard}
+  interface.scaffold: {role: implement, work: hands-on, floor: easy}
+  package.scaffold: {role: implement, work: hands-on, floor: easy}
   scope.define: {role: decide, work: think, floor: hard}
   code.refactor: {role: implement, work: hands-on, floor: easy}
   test.author: {role: implement, work: hands-on, floor: easy}
-  grammar.update: {role: implement, work: hands-on, floor: hard, order: scaffold}
+  grammar.update: {role: implement, work: hands-on, floor: hard}
   architecture.revise: {role: decide, work: think, floor: hard}
   business.revise: {role: decide, work: think, floor: hard}
-  content.generate: {role: write, work: hands-on, floor: easy, order: scaffold}
-  docs.author: {role: write, work: hands-on, floor: easy, order: scaffold}
-  knowledge.repair: {role: write, work: think, floor: hard, order: implement}
+  content.generate: {role: write, work: hands-on, floor: easy}
+  docs.author: {role: write, work: hands-on, floor: easy}
+  knowledge.repair: {role: write, work: think, floor: hard}
   release.deliver: {role: implement, work: hands-on, floor: hard}
   scope.finish: {role: implement, work: hands-on, floor: hard}
   runtime.operate: {role: implement, work: hands-on, floor: medium}
-  review.verify: {role: verify, work: think, floor: hard, order: review}
-  handover.review: {role: verify, work: think, floor: hard, order: review}
-  e2e.verify: {role: verify, work: hands-on, floor: medium, order: ui}
-  integration.verify: {role: verify, work: hands-on, floor: hard, order: review}
-  security.verify: {role: verify, work: think, floor: hard, order: ui}
-  perf.verify: {role: verify, work: hands-on, floor: medium, order: review}
-  unit.verify: {role: verify, work: hands-on, floor: medium, order: review}
-  uat.verify: {role: verify, work: hands-on, floor: medium, order: review}
+  review.verify: {role: verify, work: think, floor: hard}
+  handover.review: {role: verify, work: think, floor: hard}
+  e2e.verify: {role: verify, work: hands-on, floor: medium}
+  integration.verify: {role: verify, work: hands-on, floor: hard}
+  security.verify: {role: verify, work: think, floor: hard}
+  perf.verify: {role: verify, work: hands-on, floor: medium}
+  unit.verify: {role: verify, work: hands-on, floor: medium}
+  uat.verify: {role: verify, work: hands-on, floor: medium}
   uat.assisted.prepare: {role: write, work: hands-on, floor: medium}
-  uat.assisted.verify: {role: verify, work: think, floor: hard, order: ui}
-  goal.validate: {role: verify, work: think, floor: hard, order: review}
+  uat.assisted.verify: {role: verify, work: think, floor: hard}
+  goal.validate: {role: verify, work: think, floor: hard}
   architecture.decide: {role: decide, work: think, floor: hard}
   business.decide: {role: decide, work: think, floor: hard}
   goal.revise: {role: decide, work: think, floor: hard}
   decision.prepare: {role: decide, work: think, floor: hard}
-  provision.ask: {role: decide, work: think, floor: hard, order: implement}
-  brand.decide: {role: write, work: think, floor: hard, order: brand}
-  interface.draw: {role: write, work: think, floor: hard, order: draw}
-  interface.asset: {role: write, work: hands-on, floor: medium, order: asset}
-  work.author: {role: write, work: think, floor: hard, order: review}
+  provision.ask: {role: decide, work: think, floor: hard}
+  brand.decide: {role: write, work: think, floor: hard}
+  interface.draw: {role: write, work: think, floor: hard}
+  interface.asset: {role: write, work: hands-on, floor: hard}
+  work.author: {role: write, work: think, floor: hard}
   implementation.plan: {role: plan, work: think, floor: hard}
-  workspace.manage: {role: plan, work: think, floor: hard, order: implement}
-  model.assessGoal: {role: plan, work: think, floor: hard, order: sol-think}
-  model.planOp: {role: plan, work: think, floor: hard, order: sol-think}
-  model.decide: {role: decide, work: think, floor: hard, order: sol-think}
-  model.manageWorkflow: {role: decide, work: think, floor: hard, order: sol-think}
-  model.validateOp: {role: verify, work: think, floor: hard, order: sol-think}
-  model.critiqueGoal: {role: verify, work: think, floor: hard, order: sol-think}
-  judge: {role: verify, work: think, floor: hard, order: sol-think}
+  workspace.manage: {role: plan, work: think, floor: hard}
+  model.assessGoal: {role: plan, work: think, floor: hard}
+  model.planOp: {role: plan, work: think, floor: hard}
+  model.decide: {role: decide, work: think, floor: hard}
+  model.manageWorkflow: {role: decide, work: think, floor: hard}
+  model.validateOp: {role: verify, work: think, floor: hard}
+  model.critiqueGoal: {role: verify, work: think, floor: hard}
+  judge: {role: verify, work: think, floor: hard}