@topolo/cli 0.13.17 → 0.13.19

package/README.md

@@ -537,10 +537,24 @@ exchanges the stored refresh token for a new pair before making the request
 and rewrites the config — no user action required. The OAuth `client_id` used
 at login is persisted alongside the credential so refresh can re-authenticate.
 
-If refresh fails (network, rotated/revoked refresh token), the CLI proceeds
-with the stale credential and the request returns `auth_error` — run
-`topolo auth login` to re-authenticate. The stored config is not cleared on
-transient refresh failures.
+If refresh fails for a transient reason (network, a 5xx, a rate limit), the
+saved grant is kept and the request fails with a retryable error; a rate limit
+reports `rate_limited` with `retryAfter`, and the CLI never retries a refresh
+on its own.
+
+If Auth refuses the grant (`invalid_grant` or `expired_token`), the saved
+sign-in has ended. It is removed once, under the config lock, and is never sent
+again by any process, so a dead sign-in cannot use up the token endpoint's
+failure limit for everything else on the machine. One shared device
+re-authorization is started for that environment and context, and then:
+
+- **At a terminal**, the CLI opens the approval page, prints its URL and code,
+  waits for approval and continues the command with the new credential.
+- **Anywhere else** (no terminal, `CI` set, or `TOPOLO_NO_REAUTH_PROMPT=1`), the
+  command exits with code 2 and a structured `reauth_required` error that
+  carries the approval link, user code, expiry and the equivalent
+  `topolo auth login` command. The device code is never printed. Approve the
+  link (or run the login command) and the next command continues.
 
 ## Topolo Agent Packs
 

package/agent-packs/README.md

@@ -722,3 +722,51 @@ Only existing owned physical destinations inside the library can change. Shared
 Apply reserves `launchers/adoption-<UUID>.json` exclusively. The journal starts in `may-have-config-effects`, records each verified replacement, and becomes `configuration-prepared-native-adoption-unverified` only after all readbacks. Every write rechecks generation, source, profile metadata, preservation pins and destination custody. An interrupted or conflicting apply retains the journal and any uncertain temporary file; it never automatically replays or rolls back. Reconcile exact effects with the original owner.
 
 No apply result proves native reload, identity, current RBAC, model/effort, loaded context, original-intake permission routing or a native tool result. Hosts may react to configuration changes; admit the actual affected owner/generation and normal request settlement before applying in a live host. Later ordinary startup can renew the private credential and load identity. A previous 429/403 or scoped recovery hold remains separately applicable and elapsed time grants no retry. Actual Codex and Claude same-query context, permission, nonce result, cancellation/settlement and own retirement require independent native evidence.
+
+## Throughput and adaptive reasoning
+
+New task-model templates use revision 2. Codex chooses Luna/low only for an
+explicit `trivial`, low-risk `format`, `extract-fields`, `reference-lookup` or
+`status-read` task. Routine tasks use Sol/low (with medium as a declared effort
+alternative); standard tasks use Sol/medium; complex and security-critical
+tasks use Sol/high. Astra remains available only through an authorized explicit
+override. Unavailable models/efforts refuse rather than silently falling back.
+Existing installed configurations and fixed native sessions are not migrated by
+upgrading the adapter. Review and install a current `models-template`, then verify
+the actual native model/effort acknowledgement for every task. `low` is the native
+name for light reasoning.
+
+`topolo agent-packs lane allocate --input snapshot.json` returns a bounded,
+read-only allocation plan. The closed version-1 input contains `now` (epoch
+seconds), `maxAgeSeconds` (1–3600), actual execution `slots` (0–32),
+`maxNewLanes` (0–8), `tasks`, `lanes`, `completed`, `configuration` and `catalog`.
+The configuration/catalog use the existing task-model contracts. Each task has
+`id`, `capability`, `priority` (0 is highest), `owner` (lane ID or null),
+`dependencies` (completed task IDs), `authorized`, `paused` and `modelTask`.
+Each lane has `id`, `capabilities`, `observedAt`, `registryState`
+(idle/busy/held/paused/unknown), `nativeState` (idle/busy/unknown), `activeTask`
+(ID or null), `retainedTasks`, `reusableCheckpoint`, `assignments`,
+`lastAssigned` and its explicit model `constraints`.
+
+The allocator considers every compatible worker rather than preferring an
+ordinal. It chooses the least assigned, then oldest assigned worker; never
+moves an owned task; permits retained custody only at an explicit idle safe
+checkpoint; isolates stale/contradictory observations and blocked dependencies;
+and limits both existing work and proposed new lanes by supplied execution
+capacity. A worker receives at most one assignment per plan. The caller must
+supply trustworthy current observations; a timestamp in JSON does not prove
+native availability or admission.
+
+The result's snapshot digest must be checked by the canonical claim writer
+before an exclusive assignment. Each assignment includes its full model
+resolution with `nativeACK: null`. Create requests are proposals requiring the
+normal registered native lifecycle, not created agents or claims. This command
+does not claim, dispatch, wake, schedule, execute or retire anything. Native
+settings, authority, actual delivery and completion remain independently
+verified boundaries. In particular, it does not repair or establish a hidden
+cross-chat event transport by writing a file.
+
+Fresh-role `config.json` model/effort presets are retained in the captured agent
+manifest and used when compiling its Codex runtime policy. They do not revert
+to a legacy high-effort role default on activation. A missing preset keeps the
+legacy profile unchanged. Native catalog and exact settings readback still apply.

package/agent-packs/coverage_changed.py

@@ -15,7 +15,7 @@ from coverage.parser import PythonParser
 
 RELEASE_BASE = '6a13ada56844712aae58738ba01dbbdf90718bef'
 SOURCE = pathlib.Path('agent-packs/src/topolo_agent_pack')
-MODULES = {'topolo', 'claude', 'policy', 'permissions', 'approvals', 'execution', 'live', 'cli', 'lanes', 'task_models'}
+MODULES = {'topolo', 'claude', 'policy', 'permissions', 'approvals', 'execution', 'live', 'cli', 'lanes', 'task_models', 'throughput'}
 
 
 class CoverageRefused(RuntimeError):

package/agent-packs/src/topolo_agent_pack/cli.py

@@ -331,7 +331,7 @@ def parser():
     q.add_argument('--connection');q.add_argument('--intake');q.add_argument('--fingerprint');q.add_argument('--response')
     q.add_argument('--human-decision-recorded',action='store_true')
     q=sub.add_parser('lane',help='Plan, adopt and verify one pack-managed native child through its original intake')
-    q.add_argument('operation',choices=['plan','adopt','configure','status','read','settle','retire','serve','close','create','context-start','context-read','fixture-start','fixture-read','models-template','models-install'])
+    q.add_argument('operation',choices=['allocate','plan','adopt','configure','status','read','settle','retire','serve','close','create','context-start','context-read','fixture-start','fixture-read','models-template','models-install'])
     q.add_argument('--connection',help='Exact explicit foreground owned lane connection ID')
     q.add_argument('--input',help='Closed operation JSON; never arbitrary native RPC or task prompts')
     q=sub.add_parser('smoke',help='Start or read one closed, bound native acceptance case; never arbitrary prompts')
@@ -411,7 +411,12 @@ def main(argv=None):
                 params=read_json(args.input) if args.input else {}
                 if not isinstance(params,dict):
                     raise PackError('Closed native lane input object required')
-                if args.operation in {'models-template','models-install'}:
+                if args.operation=='allocate':
+                    from .throughput import allocate
+                    if not isinstance(params.get('catalog'),dict) or params['catalog'].get('harness')!=harness:
+                        raise PackError('Allocation catalog must match the selected native harness')
+                    result=allocate(params)
+                elif args.operation in {'models-template','models-install'}:
                     from . import lanes
                     if args.operation=='models-template':
                         if set(params)!={'pack'}:

package/agent-packs/src/topolo_agent_pack/execution.py

@@ -62,7 +62,7 @@ class ExecutionGate:
             required = {'model', 'model_reasoning_effort', 'approval_policy', 'approvals_reviewer',
                         'sandbox_mode', 'sandbox_workspace_write', 'apps'}
             if (set(spec) != required or not isinstance(spec['model'], str) or not spec['model'] or
-                    (spec['model_reasoning_effort'] not in {'medium', 'high'} and not
+                    (spec['model_reasoning_effort'] not in {'low', 'medium', 'high'} and not
                      (role.get('dynamicLaneId') and role.get('dynamicModelResolution', {}).get('resolved') ==
                       {'model': spec['model'], 'effort': spec['model_reasoning_effort']})) or
                     spec['approval_policy'] not in {'on-request', 'never'} or spec['approvals_reviewer'] != 'user' or

package/agent-packs/src/topolo_agent_pack/fresh.py

@@ -122,7 +122,7 @@ def create(lib,source,name,directory,binary,sets=None,agents=None,authored=None)
                 if preset:b.call('thread/settings/update',{'threadId':tid,'model':preset['model'],'effort':preset['reasoningEffort']})
                 note='Fresh '+a['title']+'. Read AGENTS.md and relevant context/ files for operating instructions. No task is assigned. Wait for a new human request.'
                 b.call('thread/inject_items',{'threadId':tid,'items':[{'type':'message','role':'user','content':[{'type':'input_text','text':note}]}]});b.call('thread/unsubscribe',{'threadId':tid})
-                seeded.append({**a,'pack':name,'threadId':tid});records.append((tid,result['thread']['path'],note))
+                seeded.append({**a,'pack':name,'threadId':tid,**({'modelPreset':preset} if preset else {})});records.append((tid,result['thread']['path'],note))
         team='# Fresh pack team\n\nResolve peer identities here for human-authorized coordination. Every member starts with no task or claim. This roster grants no external messaging or product effects.\n\n'+'\n'.join('- '+a['set']+'/'+a['id']+' | '+a['title']+' | thread '+a['threadId'] for a in seeded)+'\n'
         for a in seeded:
             target=root/'workspaces'/a['set']/a['id']/'context'/'TEAM.md';target.parent.mkdir(parents=True,exist_ok=True);target.write_text(team)

package/agent-packs/src/topolo_agent_pack/policy.py

@@ -59,6 +59,14 @@ def settings(agent, harness, consent=None):
     spec = PROFILES[profile]
     model = MODELS[harness][spec['tier']]
     if harness == 'codex':
+        if 'modelPreset' in agent:
+            preset = agent['modelPreset']
+            if (not isinstance(preset, dict) or set(preset) != {'model', 'reasoningEffort'} or
+                    not isinstance(preset['model'], str) or not preset['model'] or
+                    preset['model'].endswith('-latest') or preset['reasoningEffort'] not in {'low', 'medium', 'high'}):
+                raise PackError('Invalid explicit fresh-role model preset')
+            model = preset['model']
+            spec = {**spec, 'effort': preset['reasoningEffort']}
         native = {'model': model, 'model_reasoning_effort': spec['effort'],
                   'approval_policy': 'on-request', 'approvals_reviewer': 'user',
                   'sandbox_mode': spec['localAccess'],

package/agent-packs/src/topolo_agent_pack/task_models.py

@@ -16,23 +16,27 @@ def digest(value):
 def default_configuration():
     """Explicit template for a new pack configuration; existing roles are unchanged."""
     return {
-        'format': 'topolo-task-model-configuration', 'schemaVersion': 1, 'revision': '1',
+        'format': 'topolo-task-model-configuration', 'schemaVersion': 1, 'revision': '2',
         'rules': [
-            {'id': 'routine', 'complexity': ['routine'], 'risk': ['low'], 'profile': 'routine'},
+            {'id': 'trivial', 'complexity': ['trivial'], 'risk': ['low'], 'profile': 'trivial',
+             'types': ['format', 'extract-fields', 'reference-lookup', 'status-read']},
+            {'id': 'routine', 'complexity': ['routine'], 'risk': ['low', 'normal'], 'profile': 'routine'},
             {'id': 'deep', 'complexity': ['complex'], 'risk': ['low', 'normal', 'security-critical'], 'profile': 'deep'},
             {'id': 'security', 'complexity': ['routine', 'standard'], 'risk': ['security-critical'], 'profile': 'deep'},
             {'id': 'standard', 'complexity': ['standard'], 'risk': ['low', 'normal'], 'profile': 'standard'},
         ],
         'harnesses': {
             'codex': {
-                'tiers': {'standard': 'gpt-6.1-sol', 'deep': 'gpt-6-astra'},
-                'profiles': {'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
+                'tiers': {'standard': 'gpt-6.1-sol', 'deep': 'gpt-6-astra', 'economy': 'gpt-6-luna'},
+                'profiles': {'trivial': {'tier': 'economy', 'efforts': ['low']},
+                             'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
                              'standard': {'tier': 'standard', 'efforts': ['medium']},
-                             'deep': {'tier': 'deep', 'efforts': ['high']}},
+                             'deep': {'tier': 'standard', 'efforts': ['high']}},
             },
             'claude': {
                 'tiers': {'economy': 'claude-haiku-5-5', 'standard': 'claude-sonnet-5-5', 'deep': 'claude-opus-5-5'},
-                'profiles': {'routine': {'tier': 'economy', 'efforts': ['low', 'medium']},
+                'profiles': {'trivial': {'tier': 'economy', 'efforts': ['low']},
+                             'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
                              'standard': {'tier': 'standard', 'efforts': ['medium']},
                              'deep': {'tier': 'deep', 'efforts': ['high']}},
             },
@@ -80,7 +84,7 @@ def _selection(configuration, task, harness, constraints, *, override_authorized
     if (not isinstance(task, dict) or not {'type', 'complexity', 'risk'} <= set(task) or
             set(task) - {'type', 'complexity', 'risk', 'override'} or
             not isinstance(task['type'], str) or not task['type'] or len(task['type']) > 120 or
-            task['complexity'] not in {'routine', 'standard', 'complex'} or
+            task['complexity'] not in {'trivial', 'routine', 'standard', 'complex'} or
             task['risk'] not in {'low', 'normal', 'security-critical'}):
         raise PackError('An intake must supply an exact task type, complexity and risk')
     rules = configuration.get('rules')

package/agent-packs/src/topolo_agent_pack/throughput.py

@@ -0,0 +1,149 @@
+"""Bounded allocation decisions, without claim writes, wakeups or ownership changes.
+
+Callers supply current canonical and native observations, then atomically claim
+against snapshotDigest before dispatch. A plan is never evidence of execution.
+"""
+from .storage import PackError
+from .task_models import digest, resolve
+
+
+def _require(condition, message):
+    if not condition:
+        raise PackError(message)
+
+
+def _keys(value, fields):
+    _require(isinstance(value, dict) and set(value) == set(fields.split()),
+             'Allocation input requires exact fields: ' + fields)
+
+
+def _text(value):
+    return isinstance(value, str) and 0 < len(value) <= 240
+
+
+def _integer(value, minimum, maximum):
+    return type(value) is int and minimum <= value <= maximum
+
+
+def _names(value):
+    return (isinstance(value, list) and len(value) <= 256 and
+            all(_text(item) for item in value) and len(value) == len(set(value)))
+
+
+def allocate(snapshot):
+    """Choose compatible idle workers fairly; isolate stale/blocked work.
+
+    Observations are supplied evidence, not a native status probe. Existing
+    owners stay pinned. Retained custody is reusable only at an explicit safe
+    checkpoint with the actual native worker idle. Resource slots are separate
+    from chat availability and apply to both existing and proposed workers.
+    """
+    _keys(snapshot, 'schemaVersion now maxAgeSeconds slots maxNewLanes tasks lanes completed configuration catalog')
+    _require(snapshot['schemaVersion'] == 1 and
+             _integer(snapshot['now'], 1, 2**53) and
+             _integer(snapshot['maxAgeSeconds'], 1, 3600) and
+             _integer(snapshot['slots'], 0, 32) and
+             _integer(snapshot['maxNewLanes'], 0, 8) and
+             _names(snapshot['completed']), 'Invalid allocation bounds')
+    tasks, lanes = snapshot['tasks'], snapshot['lanes']
+    _require(isinstance(tasks, list) and len(tasks) <= 256 and
+             isinstance(lanes, list) and len(lanes) <= 256, 'Bounded task and lane lists required')
+    task_ids, lane_ids = set(), set()
+    for task in tasks:
+        _keys(task, 'id capability priority owner dependencies authorized paused modelTask')
+        _require(_text(task['id']) and task['id'] not in task_ids and
+                 _text(task['capability']) and _integer(task['priority'], 0, 9) and
+                 (task['owner'] is None or _text(task['owner'])) and
+                 _names(task['dependencies']) and task['id'] not in task['dependencies'] and
+                 type(task['authorized']) is bool and type(task['paused']) is bool,
+                 'Malformed or duplicate allocation task')
+        task_ids.add(task['id'])
+    for lane in lanes:
+        _keys(lane, 'id capabilities observedAt registryState nativeState activeTask retainedTasks reusableCheckpoint assignments lastAssigned constraints')
+        _require(_text(lane['id']) and lane['id'] not in lane_ids and
+                 _names(lane['capabilities']) and _names(lane['retainedTasks']) and
+                 _integer(lane['observedAt'], 1, 2**53) and
+                 lane['registryState'] in {'idle', 'busy', 'held', 'paused', 'unknown'} and
+                 lane['nativeState'] in {'idle', 'busy', 'unknown'} and
+                 (lane['activeTask'] is None or _text(lane['activeTask'])) and
+                 type(lane['reusableCheckpoint']) is bool and
+                 _integer(lane['assignments'], 0, 2**53) and
+                 _integer(lane['lastAssigned'], 0, 2**53), 'Malformed or duplicate allocation lane')
+        lane_ids.add(lane['id'])
+    completed = set(snapshot['completed'])
+    _require(not completed.intersection(task_ids), 'Completed tasks must not remain in the ready queue')
+    result = {'format': 'topolo-allocation-plan', 'schemaVersion': 1,
+              'snapshotDigest': digest(snapshot), 'assignments': [], 'createRequests': [],
+              'blocked': [], 'laneIssues': [], 'effectsStarted': False,
+              'executionRequirements': ['current exclusive claim against snapshotDigest',
+                                        'native model and effort acknowledgement',
+                                        'verified authorized task delivery and result readback']}
+    eligible = []
+    for lane in lanes:
+        age = snapshot['now'] - lane['observedAt']
+        issue = None
+        if age < 0 or age > snapshot['maxAgeSeconds']:
+            issue = 'stale-observation'
+        elif lane['registryState'] in {'paused', 'unknown'} or lane['nativeState'] == 'unknown':
+            issue = 'paused-or-unknown'
+        elif lane['activeTask'] is not None or lane['nativeState'] == 'busy':
+            issue = 'occupied'
+        elif lane['registryState'] == 'busy':
+            issue = 'reconcile-registry-with-idle-native'
+        elif lane['retainedTasks'] or lane['registryState'] == 'held':
+            if not lane['reusableCheckpoint']:
+                issue = 'custody-checkpoint-required'
+        if issue:
+            result['laneIssues'].append({'laneId': lane['id'], 'reason': issue})
+        else:
+            eligible.append(lane)
+    slots = snapshot['slots']
+    for task in sorted(tasks, key=lambda row: (row['priority'], row['id'])):
+        reason = None
+        if task['paused']:
+            reason = 'task-paused'
+        elif not task['authorized']:
+            reason = 'task-unauthorized'
+        elif not set(task['dependencies']).issubset(completed):
+            reason = 'dependencies-pending'
+        elif not slots:
+            reason = 'execution-capacity-exhausted'
+        if reason:
+            result['blocked'].append({'taskId': task['id'], 'reason': reason})
+            continue
+        compatible = [lane for lane in lanes if task['capability'] in lane['capabilities'] and
+                      (task['owner'] is None or lane['id'] == task['owner'])]
+        candidates = sorted((lane for lane in compatible if lane in eligible),
+                            key=lambda row: (row['assignments'], row['lastAssigned'], row['id']))
+        failures = []
+        for lane in candidates:
+            try:
+                resolution = resolve(snapshot['configuration'], task['modelTask'],
+                                     snapshot['catalog'].get('harness'), snapshot['catalog'], lane['constraints'])
+            except (PackError, AttributeError) as error:
+                failures.append({'laneId': lane['id'], 'reason': str(error)})
+                continue
+            result['assignments'].append({'taskId': task['id'], 'laneId': lane['id'],
+                                          'resolution': resolution,
+                                          'retainedTasks': list(lane['retainedTasks'])})
+            eligible.remove(lane)
+            slots -= 1
+            break
+        else:
+            uncertain = any(issue['laneId'] in {lane['id'] for lane in compatible} and
+                            issue['reason'] in {'stale-observation', 'paused-or-unknown',
+                                                'reconcile-registry-with-idle-native'}
+                            for issue in result['laneIssues'])
+            if (task['owner'] is None and not candidates and not uncertain and
+                    len(result['createRequests']) < snapshot['maxNewLanes']):
+                result['createRequests'].append({'taskId': task['id'], 'capability': task['capability'],
+                                                  'reason': 'no-compatible-free-lane',
+                                                  'requires': 'registered native lane and verified task model before claim'})
+                slots -= 1
+            else:
+                result['blocked'].append({'taskId': task['id'],
+                                          'reason': ('model-unavailable' if failures else
+                                                     'lane-state-reconciliation-required' if uncertain else
+                                                     'owner-or-capability-unavailable'),
+                                          'modelFailures': failures})
+    return result