@vtxmacro/cli 2026.8.32 → 2026.8.34

package/README.md

@@ -86,6 +86,13 @@ distinct. Use `service uninstall --instance <name>` to remove one worker;
 unqualified `service uninstall` removes the whole supervisor. The legacy
 unqualified host commands continue to target `default`.
 
+For one VTX account and adapter, the selected host is tried first and other
+compatible memberships follow in setup order. Quota/credits exhaustion,
+unusable authentication, and exhausted recoverable provider failures can
+advance the same logical call. VTX never changes provider, model, effort, or
+response mode, and never cascades a bad request, policy rejection, or uncertain
+dispatch outcome.
+
 Automated hosts do not impose a subscription-specific profile-count or
 concurrency limit by default. Set an explicit positive integer with
 `--max-concurrency` when you want a local limit. Every active turn shares the live subscription

package/bin/vtx.js

@@ -38,7 +38,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.8.32",
+      package_version: "2026.8.34",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       platforms: {
@@ -14375,7 +14375,7 @@ var init_zod = __esm({
 });
 
 // lib/external-inference-contract.ts
-var EXTERNAL_INFERENCE_CONTRACT_VERSION, EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION, EXTERNAL_INFERENCE_ADVERTISEMENT_SCHEMA_VERSION, EXTERNAL_INFERENCE_ENVELOPE_SCHEMA_VERSION, EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION, EXTERNAL_INFERENCE_INPUT_HASH_DOMAIN, MAX_EXTERNAL_INFERENCE_STATUS_HOSTS, MAX_GENERATION, MAX_SAFE_INTEGER, MAX_PROMPT_BYTES, MAX_IMMUTABLE_JOB_INPUT_BYTES, MAX_CANDIDATE_PLAINTEXT_BYTES, MAX_CIPHERTEXT_CHARS, SHA256_INITIAL_STATE, SHA256_ROUND_CONSTANTS, rotateRight, sha256BytesHex, sha256Utf8Hex, computeImmutableJobInputSha256, identifierSchema, operationIdentifierSchema, sha256HexSchema, generationSchema, zeroBasedGenerationSchema, nonNegativeSafeIntegerSchema, positiveSafeIntegerSchema, sqlIntegerTokenCountSchema, timestampSchema, safeCodeSchema, externalInferenceAdapterIdSchema, reasoningEffortSchema, modelNameSchema, displayNameSchema, authenticatedAccountEmailSchema, protocolVersionSchema, base64UrlAlphabet, isCanonicalBase64Url, base64Url32BytesSchema, base64UrlNonceSchema, base64UrlCiphertextSchema, claimHandleSchema, boundedJsonTextSchema, boundedPromptTextSchema, laneSchema, botModeSchema, executionModeSchema, responseModeSchema, dispatchOutcomeSchema, responseOutcomeSchema, nativeModelControllerSchema, externalAgentModelControllerSchema, externalAgentUnboundControllerSchema, liveModelControllerSchema, snapshotModelControllerSchema, modelIdentityMappingSchema, advertisedModelSchema, hostAdvertisementSchema, envelopeAadSchema, validateEnvelopeAad, commonEnvelopeShape, sealedKeyWrapEnvelopeSchema, sealedInputEnvelopeSchema, sealedCandidateEnvelopeSchema, sealedEnvelopeSchema, screenerCandidateRuntimeBindingSchema, screenerClientLeaseBindingSchema, screenerRuntimeBindingSchema, serverRuntimeBindingSchema, clientRuntimeBindingSchema, runtimeBindingSchema, immutableJobInputSchema, canonicalizeJsonValue, serializeImmutableJobInput, reportedTokenUsageSchema, unavailableTokenUsageSchema, tokenUsageSchema, agentConnectRequestSchema, agentNextRequestSchema, agentHeartbeatRequestSchema, emptyAgentNextResultSchema, claimedAgentNextResultSchema, agentNextResultSchema, agentCompleteRequestSchema, agentFailRequestSchema, requestedModelSelectionSchema, completedModelProvenanceSchema, attemptModelProvenanceSchema, providerWeeklyQuotaReadSchema, hostHeartbeatRequestSchema, jobClaimRequestSchema, emptyJobClaimSchema, claimedJobSchema, jobClaimResultSchema, attemptStartRequestSchema, jobHeartbeatRequestSchema, continueHeartbeatDirectiveSchema, cancelHeartbeatDirectiveSchema, jobHeartbeatResultSchema, adapterOutcomeEvidenceSchema, completionBaseShape, validateCompletion, providerResponseCompletionSchema, decisionCandidateCompletionSchema, jobCompleteRequestSchema, jobFailRequestSchema, jobCancelRequestSchema, jobCancellationReceiptSchema, jobDeliveryRequestSchema, deliveryBaseShape, validateDeliveryCandidate, providerResponseDeliverySchema, decisionCandidateDeliverySchema, jobDeliveryResultSchema, jobConsumptionRequestSchema, jobConsumptionReceiptSchema, jobStateSchema, jobStatusReadSchema, hostStatusReadSchema, controllerBindingStatusReadSchema, queueStatusReadSchema, outcomeStatusReadSchema, externalInferenceVolumeWindowReadSchema, externalInferenceFailureCountReadSchema, externalInferenceHostDiagnosticsReadSchema, externalInferenceProfileActivityReadSchema, externalInferenceStatusReadSchema, nativeResearchEvidenceSourceSchema, externalAgentResearchEvidenceSourceSchema, researchEvidenceSourceSchema, reportedResearchTokenUsageSchema, unavailableResearchTokenUsageSchema, researchTokenUsageSchema, externalInferenceProductLineageBaseShape, traderExternalInferenceProductLineageSchema, decisionChatExternalInferenceProductLineageSchema, screenerExternalInferenceProductLineageSchema, externalInferenceProductLineageSchema, normalProductLinkageSchema, evidenceMaterializationMarkerSchema, deliveredExternalAgentSourceIdentitySchema, deliveredRequestEvidenceSchema, researchEvidenceBaseShape, researchEvidenceBaseSchema, validateExactUtf8, validateResearchEvidence, providerResponseResearchEvidenceSchema, decisionCandidateResearchEvidenceSchema, researchEvidenceSchema;
+var EXTERNAL_INFERENCE_CONTRACT_VERSION, EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION, EXTERNAL_INFERENCE_ADVERTISEMENT_SCHEMA_VERSION, EXTERNAL_INFERENCE_ENVELOPE_SCHEMA_VERSION, EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, LEGACY_EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION, EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION, EXTERNAL_INFERENCE_INPUT_HASH_DOMAIN, MAX_EXTERNAL_INFERENCE_STATUS_HOSTS, MAX_GENERATION, MAX_SAFE_INTEGER, MAX_PROMPT_BYTES, MAX_IMMUTABLE_JOB_INPUT_BYTES, MAX_CANDIDATE_PLAINTEXT_BYTES, MAX_CIPHERTEXT_CHARS, SHA256_INITIAL_STATE, SHA256_ROUND_CONSTANTS, rotateRight, sha256BytesHex, sha256Utf8Hex, computeImmutableJobInputSha256, identifierSchema, operationIdentifierSchema, sha256HexSchema, generationSchema, zeroBasedGenerationSchema, nonNegativeSafeIntegerSchema, positiveSafeIntegerSchema, sqlIntegerTokenCountSchema, timestampSchema, safeCodeSchema, externalInferenceAdapterIdSchema, reasoningEffortSchema, modelNameSchema, displayNameSchema, authenticatedAccountEmailSchema, protocolVersionSchema, base64UrlAlphabet, isCanonicalBase64Url, base64Url32BytesSchema, base64UrlNonceSchema, base64UrlCiphertextSchema, claimHandleSchema, boundedJsonTextSchema, boundedPromptTextSchema, laneSchema, botModeSchema, executionModeSchema, responseModeSchema, dispatchOutcomeSchema, responseOutcomeSchema, nativeModelControllerSchema, externalAgentModelControllerSchema, externalAgentUnboundControllerSchema, liveModelControllerSchema, snapshotModelControllerSchema, modelIdentityMappingSchema, advertisedModelSchema, hostAdvertisementSchema, envelopeAadSchema, validateEnvelopeAad, commonEnvelopeShape, sealedKeyWrapEnvelopeSchema, sealedInputEnvelopeSchema, sealedCandidateEnvelopeSchema, sealedEnvelopeSchema, screenerCandidateRuntimeBindingSchema, screenerClientLeaseBindingSchema, screenerRuntimeBindingSchema, serverRuntimeBindingSchema, clientRuntimeBindingSchema, runtimeBindingSchema, immutableJobInputSchema, canonicalizeJsonValue, serializeImmutableJobInput, reportedTokenUsageSchema, unavailableTokenUsageSchema, tokenUsageSchema, agentConnectRequestSchema, agentNextRequestSchema, agentHeartbeatRequestSchema, emptyAgentNextResultSchema, claimedAgentNextResultSchema, agentNextResultSchema, agentCompleteRequestSchema, agentFailRequestSchema, requestedModelSelectionSchema, completedModelProvenanceSchema, attemptModelProvenanceSchema, providerWeeklyQuotaReadSchema, hostHeartbeatRequestSchema, jobClaimRequestSchema, emptyJobClaimSchema, claimedJobSchema, jobClaimResultSchema, attemptStartRequestSchema, jobHeartbeatRequestSchema, continueHeartbeatDirectiveSchema, cancelHeartbeatDirectiveSchema, jobHeartbeatResultSchema, adapterOutcomeEvidenceSchema, completionBaseShape, validateCompletion, providerResponseCompletionSchema, decisionCandidateCompletionSchema, jobCompleteRequestSchema, jobFailRequestSchema, jobCancelRequestSchema, jobCancellationReceiptSchema, jobDeliveryRequestSchema, deliveryBaseShape, validateDeliveryCandidate, providerResponseDeliverySchema, decisionCandidateDeliverySchema, jobDeliveryResultSchema, jobConsumptionRequestSchema, jobConsumptionReceiptSchema, jobStateSchema, jobStatusReadSchema, hostStatusReadSchema, controllerBindingStatusReadSchema, queueStatusReadSchema, outcomeStatusReadSchema, externalInferenceVolumeWindowReadSchema, externalInferenceFailureCountReadSchema, externalInferenceHostDiagnosticsReadSchema, externalInferenceProfileActivityReadSchema, externalInferenceStatusReadSchema, nativeResearchEvidenceSourceSchema, externalAgentResearchEvidenceSourceSchema, researchEvidenceSourceSchema, reportedResearchTokenUsageSchema, unavailableResearchTokenUsageSchema, researchTokenUsageSchema, externalInferenceProductLineageBaseShape, traderExternalInferenceProductLineageSchema, decisionChatExternalInferenceProductLineageSchema, screenerExternalInferenceProductLineageSchema, externalInferenceProductLineageSchema, normalProductLinkageSchema, evidenceMaterializationMarkerSchema, deliveredExternalAgentSourceIdentitySchema, deliveredRequestEvidenceSchema, researchEvidenceBaseShape, researchEvidenceBaseSchema, validateExactUtf8, validateResearchEvidence, providerResponseResearchEvidenceSchema, decisionCandidateResearchEvidenceSchema, researchEvidenceSchema;
 var init_external_inference_contract = __esm({
   "lib/external-inference-contract.ts"() {
     "use strict";
@@ -14384,7 +14384,8 @@ var init_external_inference_contract = __esm({
     EXTERNAL_INFERENCE_CONTROLLER_SCHEMA_VERSION = "external_inference_controller_v1";
     EXTERNAL_INFERENCE_ADVERTISEMENT_SCHEMA_VERSION = "external_inference_advertisement_v1";
     EXTERNAL_INFERENCE_ENVELOPE_SCHEMA_VERSION = "external_inference_envelope_v1";
-    EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION = "external_inference_job_input_v1";
+    EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION = "external_inference_job_input_v2";
+    LEGACY_EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION = "external_inference_job_input_v1";
     EXTERNAL_INFERENCE_USAGE_SCHEMA_VERSION = "external_inference_usage_v1";
     EXTERNAL_INFERENCE_INPUT_HASH_DOMAIN = "vtx.external-inference.input-sha256.v1\0";
     MAX_EXTERNAL_INFERENCE_STATUS_HOSTS = 640;
@@ -14538,6 +14539,7 @@ var init_external_inference_contract = __esm({
         ["analysis_run_id", values.analysis_run_id],
         ["cycle_id", values.cycle_id],
         ["request_id", values.request_id],
+        ...values.use_case !== void 0 && values.role !== void 0 ? [["use_case", values.use_case], ["role", values.role]] : [],
         ["system_prompt", values.system_prompt],
         ["user_prompt", values.user_prompt],
         ["context_json", values.context_json],
@@ -14865,16 +14867,34 @@ var init_external_inference_contract = __esm({
     });
     runtimeBindingSchema = external_exports.discriminatedUnion("binding_kind", [
       serverRuntimeBindingSchema,
-      clientRuntimeBindingSchema
+      clientRuntimeBindingSchema,
+      external_exports.strictObject({
+        binding_kind: external_exports.literal("historical_chat"),
+        bot_mode: external_exports.literal("assistant"),
+        confirmed_active: external_exports.literal(false),
+        bot_run_id: identifierSchema,
+        analysis_run_id: identifierSchema,
+        cycle_id: identifierSchema,
+        runtime_contract_generation: generationSchema,
+        trade_decision_id: positiveSafeIntegerSchema,
+        decision_chat_generation: nonNegativeSafeIntegerSchema,
+        source_invocation_public_id: identifierSchema,
+        source_attempt_public_id: identifierSchema
+      })
     ]);
     immutableJobInputSchema = external_exports.strictObject({
-      schema_version: external_exports.literal(EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION),
+      schema_version: external_exports.union([
+        external_exports.literal(LEGACY_EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION),
+        external_exports.literal(EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION)
+      ]),
       contract_version: external_exports.literal(EXTERNAL_INFERENCE_CONTRACT_VERSION),
       job_id: identifierSchema,
       owner_id: positiveSafeIntegerSchema,
       profile_id: positiveSafeIntegerSchema,
       stable_bot_id: identifierSchema,
       request_id: identifierSchema,
+      use_case: external_exports.enum(["trader", "decision_chat", "screener"]).optional(),
+      role: external_exports.enum(["primary", "review", "chat", "candidate"]).optional(),
       lane: laneSchema,
       execution_mode: executionModeSchema,
       host_id: identifierSchema,
@@ -14911,7 +14931,14 @@ var init_external_inference_contract = __esm({
       deadline_at: timestampSchema,
       evidence_expires_at: timestampSchema
     }).superRefine((value, context) => {
-      if (value.runtime_binding.binding_kind !== value.execution_mode) {
+      if (value.schema_version === EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION) {
+        if (value.use_case === void 0 || value.role === void 0) {
+          context.addIssue({ code: "custom", message: "v2 job input requires immutable use_case and role" });
+        }
+      } else if (value.use_case !== void 0 || value.role !== void 0) {
+        context.addIssue({ code: "custom", message: "v1 job input cannot contain v2 product identity" });
+      }
+      if (value.runtime_binding.binding_kind !== value.execution_mode && !(value.runtime_binding.binding_kind === "historical_chat" && value.execution_mode === "server" && value.use_case === "decision_chat")) {
         context.addIssue({ code: "custom", message: "runtime binding must match execution_mode", path: ["runtime_binding", "binding_kind"] });
       }
       if (value.lane === "screener" && value.runtime_binding.bot_mode !== "trader") {
@@ -14953,6 +14980,8 @@ var init_external_inference_contract = __esm({
         analysis_run_id: value.runtime_binding.analysis_run_id,
         cycle_id: value.runtime_binding.cycle_id,
         request_id: value.request_id,
+        use_case: value.schema_version === EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION ? value.use_case : void 0,
+        role: value.schema_version === EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION ? value.role : void 0,
         system_prompt: value.system_prompt,
         user_prompt: value.user_prompt,
         context_json: value.context_json,
@@ -15414,6 +15443,13 @@ var init_external_inference_contract = __esm({
       failure_category: safeCodeSchema,
       failure_code: safeCodeSchema,
       retryable: external_exports.boolean(),
+      membership_disposition: external_exports.enum([
+        "retry_same_host",
+        "cascade_cooldown",
+        "cascade_disable",
+        "fail_request",
+        "quarantine_ambiguous"
+      ]).optional(),
       failed_at: timestampSchema
     }).superRefine((value, context) => {
       if (value.outcome.response_outcome !== "none") {
@@ -15423,6 +15459,9 @@ var init_external_inference_contract = __esm({
       if (value.attempt_status !== expectedStatus) {
         context.addIssue({ code: "custom", message: "attempt_status must match dispatch outcome", path: ["attempt_status"] });
       }
+      if (value.outcome.dispatch_outcome === "outcome_unknown" && value.membership_disposition !== void 0 && value.membership_disposition !== "quarantine_ambiguous") {
+        context.addIssue({ code: "custom", message: "outcome-unknown failures must be quarantined", path: ["membership_disposition"] });
+      }
       if (value.outcome.dispatch_outcome === "not_dispatched") {
         if (value.model.effective_model !== null || value.model.effective_reasoning_effort !== null) {
           context.addIssue({ code: "custom", message: "not-dispatched failures cannot report effective model provenance", path: ["model"] });
@@ -19394,6 +19433,14 @@ var init_codex_app_server = __esm({
           const details = objectOrNull(structured[variant]);
           const rawStatus = details?.httpStatusCode;
           const httpStatusCode = Number.isSafeInteger(rawStatus) && Number(rawStatus) >= 100 && Number(rawStatus) <= 599 ? Number(rawStatus) : null;
+          if (httpStatusCode === 401) {
+            return {
+              code: "auth_expired",
+              category: "auth",
+              retryable: false,
+              httpStatusCode
+            };
+          }
           if (httpStatusCode === 429) {
             return {
               code: "codex_rate_limited",
@@ -19402,10 +19449,43 @@ var init_codex_app_server = __esm({
               httpStatusCode
             };
           }
+          if (httpStatusCode !== null && httpStatusCode >= 400 && httpStatusCode < 500 && httpStatusCode !== 408 && httpStatusCode !== 425) {
+            const semanticText = JSON.stringify(details || {}).toLowerCase();
+            if (httpStatusCode === 402 || /(quota|credit|spend|payment|subscription.*limit)/u.test(semanticText)) {
+              return {
+                code: "quota_exceeded",
+                category: "model",
+                retryable: false,
+                httpStatusCode
+              };
+            }
+            if (httpStatusCode === 403 && /(auth|account|workspace|billing|entitlement)/u.test(semanticText)) {
+              return {
+                code: "auth_expired",
+                category: "auth",
+                retryable: false,
+                httpStatusCode
+              };
+            }
+            if (httpStatusCode === 403 && /(policy|safety|cyber)/u.test(semanticText)) {
+              return {
+                code: "codex_policy_rejected",
+                category: "adapter",
+                retryable: false,
+                httpStatusCode
+              };
+            }
+            return {
+              code: httpStatusCode === 400 ? "codex_bad_request" : "codex_http_client_error",
+              category: "adapter",
+              retryable: false,
+              httpStatusCode
+            };
+          }
           return {
             code,
             category: "adapter",
-            retryable: httpStatusCode === null ? variant !== "responseTooManyFailedAttempts" : httpStatusCode === 408 || httpStatusCode === 425 || httpStatusCode >= 500,
+            retryable: httpStatusCode === null ? true : httpStatusCode === 408 || httpStatusCode === 425 || httpStatusCode >= 500,
             httpStatusCode
           };
         }
@@ -20453,7 +20533,7 @@ child.once('close', async () => {
             category: error48.category,
             code: error48.code,
             retryable: error48.retryable,
-            dispatchOutcome: requestWritten ? turnId ? "confirmed_dispatched" : "outcome_unknown" : "not_dispatched",
+            dispatchOutcome: requestWritten ? "outcome_unknown" : "not_dispatched",
             cause: error48
           }));
         });
@@ -20656,7 +20736,7 @@ child.once('close', async () => {
                 category: error48.category,
                 code: error48.code,
                 retryable: error48.retryable,
-                dispatchOutcome: turnId ? "confirmed_dispatched" : "outcome_unknown",
+                dispatchOutcome: "outcome_unknown",
                 cause: error48
               });
             }
@@ -22433,7 +22513,7 @@ var init_crypto = __esm({
     decryptExternalInferenceJobInput = (jobKey, input, expectedIdentity) => {
       const envelope = sealedInputEnvelopeSchema.parse(input);
       assertIdentity(envelope.aad, expectedIdentity);
-      if (envelope.aad.direction !== "input" || envelope.aad.payload_schema_version !== EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION || envelope.aad.attempt_id !== null) {
+      if (envelope.aad.direction !== "input" || envelope.aad.payload_schema_version !== EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION && envelope.aad.payload_schema_version !== LEGACY_EXTERNAL_INFERENCE_JOB_INPUT_SCHEMA_VERSION || envelope.aad.attempt_id !== null) {
         throw new ExternalInferenceEnvelopeError(
           "identity_mismatch",
           "External inference input envelope context is invalid."
@@ -22457,6 +22537,12 @@ var init_crypto = __esm({
         );
       }
       const job = immutableJobInputSchema.parse(rawJob);
+      if (envelope.aad.payload_schema_version !== job.schema_version) {
+        throw new ExternalInferenceEnvelopeError(
+          "identity_mismatch",
+          "External inference input schema identity is inconsistent."
+        );
+      }
       if (!Buffer.from(serializeImmutableJobInput(job)).equals(plaintext)) {
         throw new ExternalInferenceEnvelopeError(
           "invalid_job_input",
@@ -28821,7 +28907,7 @@ function createDefaultInferenceHostRunnerDependencies(options) {
     envelopePublicKey: options.envelopePublicKey
   };
 }
-var import_ajv, RUNTIME_RECEIPT_SCHEMA_VERSION, ATTEMPT_RECEIPT_SCHEMA_VERSION, DEFAULT_ADVERTISEMENT_TTL_MS, DEFAULT_ADVERTISEMENT_REFRESH_LEAD_MS, DEFAULT_HOST_HEARTBEAT_MS, DEFAULT_PROVIDER_RATE_LIMIT_REFRESH_MS, DEFAULT_ATTEMPT_HEARTBEAT_MS, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_REMOTE_RETRY_LIMIT, MIN_SLEEP_MS, DEFAULT_CODEX_ACCOUNT_COOLDOWN_MS, MIN_CLAIM_START_WINDOW_MS, UNBOUNDED_AVAILABLE_SLOTS, buildCodexInferenceAdvertisedModels, FileInferenceHostRuntimeReceiptStore, InferenceHostRecoveryRequiredError, InferenceHostRunnerError, defaultSleep, abortError, defaultRegisterSignalHandlers, safeInteger, exactObjectKeys, validIso, validateAttemptReceipt, validateRuntimeReceipt, sha256, stableOperationId, buildAttemptStartRequest, isoAt, providerWeeklyQuotaFromRateLimits, finitePositiveOption, validateRunnerOptions, assertLocalCredentialIdentity, retryableRemoteError, remoteRetryAfterMs, controlPlaneFatal, defaultValidateOutput, objectRecord, positiveUtf8ByteLimit, assertCompilableOutputSchema, parseOutputContract, safeFailureCode, exactJson2, runnerIdentityMismatch, assertAdvertisementResult, assertHostHeartbeatResult, assertClaimResult, assertStartResult, assertJobHeartbeatResult, assertTerminalResult, classifyFailure, ambiguousHeartbeatTransport, reportedTokenUsage, reportedUsage, InferenceHostRunner;
+var import_ajv, RUNTIME_RECEIPT_SCHEMA_VERSION, ATTEMPT_RECEIPT_SCHEMA_VERSION, DEFAULT_ADVERTISEMENT_TTL_MS, DEFAULT_ADVERTISEMENT_REFRESH_LEAD_MS, DEFAULT_HOST_HEARTBEAT_MS, DEFAULT_PROVIDER_RATE_LIMIT_REFRESH_MS, DEFAULT_ATTEMPT_HEARTBEAT_MS, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_REMOTE_RETRY_LIMIT, MIN_SLEEP_MS, DEFAULT_CODEX_ACCOUNT_COOLDOWN_MS, MIN_CLAIM_START_WINDOW_MS, UNBOUNDED_AVAILABLE_SLOTS, buildCodexInferenceAdvertisedModels, FileInferenceHostRuntimeReceiptStore, InferenceHostRecoveryRequiredError, InferenceHostRunnerError, defaultSleep, abortError, defaultRegisterSignalHandlers, safeInteger, exactObjectKeys, validIso, validateAttemptReceipt, validateRuntimeReceipt, sha256, stableOperationId, buildAttemptStartRequest, isoAt, providerWeeklyQuotaFromRateLimits, finitePositiveOption, validateRunnerOptions, assertLocalCredentialIdentity, retryableRemoteError, remoteRetryAfterMs, controlPlaneFatal, defaultValidateOutput, objectRecord, positiveUtf8ByteLimit, assertCompilableOutputSchema, parseOutputContract, membershipFailureDisposition, safeFailureCode, exactJson2, runnerIdentityMismatch, assertAdvertisementResult, assertHostHeartbeatResult, assertClaimResult, assertStartResult, assertJobHeartbeatResult, assertTerminalResult, classifyFailure, ambiguousHeartbeatTransport, reportedTokenUsage, reportedUsage, InferenceHostRunner;
 var init_runner = __esm({
   "lib/inference-host/runner.ts"() {
     "use strict";
@@ -29323,6 +29409,20 @@ var init_runner = __esm({
         providerReasoningSummarySupported
       };
     };
+    membershipFailureDisposition = (failure) => {
+      if (failure.dispatchOutcome === "outcome_unknown") return "quarantine_ambiguous";
+      if (failure.category === "auth" || ["auth_expired", "managed_chatgpt_auth_required", "invalid_account_metadata"].includes(failure.code)) return "cascade_disable";
+      if (failure.category === "quota" || ["quota_exceeded", "codex_rate_limited"].includes(failure.code)) return "cascade_cooldown";
+      if (failure.retryable && (["adapter", "network", "transport"].includes(failure.category) || failure.code === "rpc_timeout")) return "retry_same_host";
+      if (["model_unavailable", "reasoning_effort_unavailable"].includes(failure.code)) return "cascade_cooldown";
+      if ([
+        "codex_http_connection_failed",
+        "codex_response_stream_connection_failed",
+        "codex_response_stream_disconnected",
+        "codex_provider_retry_exhausted"
+      ].includes(failure.code)) return "cascade_cooldown";
+      return "fail_request";
+    };
     safeFailureCode = (value, fallback) => {
       const normalized = value.trim().toLowerCase().replace(/[^a-z0-9._-]+/gu, "_").slice(0, 96);
       return /^[a-z0-9]/u.test(normalized) ? normalized : fallback;
@@ -30561,6 +30661,10 @@ var init_runner = __esm({
             failure_category: failure.category,
             failure_code: failure.code,
             retryable: failure.retryable,
+            membership_disposition: membershipFailureDisposition({
+              ...failure,
+              dispatchOutcome
+            }),
             failed_at: isoAt(now())
           });
           await updateAttempt({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.8.32",
+  "version": "2026.8.34",
   "description": "VTX Macro CLI, MCP server, and durable subscription inference host.",
   "type": "module",
   "license": "UNLICENSED",