@worca/app 1.3.0 → 1.4.0

package/src/core/memory-sync.mjs

@@ -1,6 +1,6 @@
 // The per-run memory MOUNT (agent-memory-design.md §4.1, amendment A1) and the
 // hash-baselined SYNC-BACK (§5). Pure over injected paths: `root` is the store
-// (memory-store.mjs' layout), `mount` is `<runCwd>/.claude/rules/worca` (memoryMountPath). No DB, no
+// (memory-store.mjs' layout), `mount` is the WRITABLE copy `<pipeline.dir>/memory` (memoryWorkPath); the read-only rules copy is memoryRulesPath(cwd). No DB, no
 // orchestrator state, no settings reads — the harness passes caps and paths.
 import { mkdir, rm, cp, readFile, writeFile, stat, rename, unlink, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
@@ -11,16 +11,25 @@ import {
 import { MEMORY_DEFRAG_WORKFLOW_ID } from './graph/builtin-workflows.mjs';
 
 /**
- * Where the mount lives INSIDE a run's cwd (native-rules revision, 2026-09-13): Claude Code
- * discovers `<cwd>/.claude/rules/**` recursively, honours `paths:` frontmatter (comma-separated
- * string included) and hands the files to Task sub-agents — probed on claude 2.1.270 from a git
- * worktree cwd and from a non-git run root. `worca/` namespaces the mount away from a project's
- * own committed rules. Forward slashes on purpose: the string is also the git pathspec of the
- * §8.8 exclusion set (`:(exclude).claude/rules/worca`).
+ * Two copies of the store per run (memory-write-split design, 2026-09-17):
+ *  - the READ-ONLY rules copy INSIDE a run's cwd — Claude Code discovers `<cwd>/.claude/rules/**`
+ *    recursively, honours `paths:` frontmatter and hands the files to Task sub-agents (probed on
+ *    claude 2.1.270). `.claude` is one of Claude Code's PROTECTED paths: a Write/Edit there is refused
+ *    under `-p` whatever the allow rules or hooks say (probed 2.1.273), so nothing is ever written here
+ *    by an agent; worca refreshes it from the store after every sync that changed the store.
+ *  - the WRITABLE copy = the sync-back mount, `<pipeline.dir>/memory/`, outside every checkout and
+ *    cwd (no git hygiene, no tracked guard, survives a pause for the resume sync), passed to every
+ *    spawn as `--add-dir` so acceptEdits auto-approves edits there by the documented rule.
+ * `worca/` namespaces the rules copy away from a project's own committed rules. Forward slashes on
+ * purpose: MEMORY_RULES_REL is also the git pathspec of the §8.8 exclusion set.
  */
 export const MEMORY_RULES_REL = '.claude/rules/worca';
-/** `<cwd>/.claude/rules/worca` with the platform separator. */
-export function memoryMountPath(cwd) { return join(cwd, ...MEMORY_RULES_REL.split('/')); }
+/** `<cwd>/.claude/rules/worca` with the platform separator — the read-only copy. */
+export function memoryRulesPath(cwd) { return join(cwd, ...MEMORY_RULES_REL.split('/')); }
+/** The writable copy's name under the pipeline dir. */
+export const MEMORY_WORK_REL = 'memory';
+/** `<pipelineDir>/memory` — the writable copy = the sync-back mount. */
+export function memoryWorkPath(pipelineDir) { return join(pipelineDir, MEMORY_WORK_REL); }
 /**
  * The §8.8 injected-path record of the mount. `kind: 'memory'` is EXCLUDED from every commit,
  * intent-to-add staging and result diff (run-harness `_excludePathspecs`), REMOVED at teardown
@@ -179,9 +188,11 @@ const isHash = (v) => typeof v === 'string' && !v.startsWith('rejected:');
  *  `rejected:invalid` and for P1's two-part `rejected:<mountHash>` (the store never vouched). */
 const storeHashOf = (v) => (isHash(v) ? v : ((typeof v === 'string' && v.split(':')[2]) || null));
 
-/** Totals over a list of Change entries — one shape for results.json and the History detail. */
+/** Totals over a list of Change entries — one shape for results.json, the History detail and Ask's
+ *  get_run. `failed` = writes the agent attempted that never reached the mount (a refused tool call);
+ *  a record written before the write split has no `failed` array and counts as 0. */
 export function memoryTotals(changes) {
-  const totals = { added: 0, modified: 0, deleted: 0, rejected: 0 };
+  const totals = { added: 0, modified: 0, deleted: 0, rejected: 0, failed: 0 };
   for (const c of Array.isArray(changes) ? changes : []) for (const k of Object.keys(totals)) totals[k] += Array.isArray(c[k]) ? c[k].length : 0;
   return totals;
 }

package/src/core/metrics/read.mjs

@@ -214,9 +214,11 @@ function syncFor(slug, prefs, pending) {
 export async function readScope(scope, { refresh = false, defer = false } = {}) {
   const sources = [];
   let meta;
+  let rateProjectDir = null;
   if (scope.kind === 'project') {
     const p = (await listProjects()).find((x) => x.key === scope.id);
     if (!p) throw Object.assign(new Error(`unknown project ${scope.id}`), { code: 'NOT_FOUND' });
+    rateProjectDir = p.path;
     const sink = await resolveProjectSink(p.path);
     if (!sink.ok) {
       const code = sink.reason === 'delegate-invalid' ? 'DELEGATE_INVALID' : 'NOT_ENABLED';
@@ -235,6 +237,7 @@ export async function readScope(scope, { refresh = false, defer = false } = {})
       sources.push({ slug: prefs.slug, projectDir: path, keep: (r) => matchesWorkspace(r.target, ws) });
     }
     if (!sources.length) throw Object.assign(new Error(`no member of ${ws.name} records team metrics`), { code: 'NOT_ENABLED' });
+    rateProjectDir = ws.metricsProject || null;
     const homePrefs = ws.metricsProject ? readTeamMetricsPrefs(projectKey(ws.metricsProject)) : null;
     meta = { kind: 'workspace', id: ws.id, name: ws.name, home: homePrefs?.slug ?? null, sources: sources.map((s) => s.slug) };
   }
@@ -270,7 +273,7 @@ export async function readScope(scope, { refresh = false, defer = false } = {})
     }
     sync.push({ ...syncFor(src.slug, readTeamMetricsPrefs(projectKey(src.projectDir)), (await listOutbox(src.slug)).length), fetchedAt: r.fetchedAt });
   }
-  return { scope: meta, records, stats, sinks: sources.map((s) => s.slug), sync, refresh: refreshInfo, fetchError };
+  return { scope: meta, records, stats, sinks: sources.map((s) => s.slug), sync, refresh: refreshInfo, fetchError, rateProjectDir };
 }
 
 /** Scope list + Projects/Workspaces status in one call (Scope select, Projects cells, ws cards, Stats hint). */

package/src/core/metrics/record.mjs

@@ -14,6 +14,7 @@ import {
   projectSlug, gitUserName, resolveProjectSink, resolveWorkspaceSink, writeOutbox, scheduleFlush as realScheduleFlush,
 } from './sync.mjs';
 import { writeRunLedger } from './ledger.mjs';
+import { readPolicyState } from '../policy/state.mjs';
 
 export const RECORD_VERSION = 1;
 export const TEXT_MAX = 200;
@@ -22,11 +23,13 @@ export const WORCA_VERSION = createRequire(import.meta.url)('../../../package.js
 /** Serialised key order of a v1 record — diffs stay readable (§4.4). */
 export const RECORD_FIELDS = Object.freeze([
   'v', 'id', 'worca', 'recordedAt',
-  'startedAt', 'endedAt', 'wallMs', 'activeMs',
+  'startedAt', 'endedAt', 'wallMs', 'activeMs', 'pausedMs',
   'result', 'failure',
   'workflow', 'target', 'title', 'source',
   'cost', 'agents', 'steps', 'cycles', 'interventions',
   'pr', 'git', 'actor',
+  // `policy` (team-policy design §10) is an OPTIONAL trailing key: present only on runs that
+  // saw a policy, so policy-less records keep exactly this key list. Readers ignore it.
 ]);
 
 const RESULT_OF = Object.freeze({ done: 'done', error: 'failed', stopped: 'stopped' });
@@ -58,7 +61,7 @@ const num = (v) => (Number.isFinite(v) ? v : null);
 const unique = (arr) => [...new Set(arr.filter((x) => typeof x === 'string' && x))];
 
 // failure-policy REASON codes of a cost-cap pause (src/core/failure-policy.mjs).
-const BUDGET_PAUSE = new Set(['cost_pipeline', 'cost_total']);
+const BUDGET_PAUSE = new Set(['cost_pipeline', 'cost_total', 'cost_pipeline_policy', 'cost_total_policy']);
 
 /**
  * failure (§4.4). Cost caps and setup failures PAUSE the run, so the last pause reason is
@@ -112,6 +115,19 @@ function buildSource(src) {
   };
 }
 
+/** money-saved design §7: hours from the run, byPhase from the agent steps (UI phase, like cost.byPhase). */
+function buildHuman(agentSteps, humanHours) {
+  const hours = Number.isFinite(humanHours) ? Math.round(humanHours * 100) / 100 : 0;
+  if (hours <= 0) return null;
+  const byPhase = {};
+  for (const s of agentSteps) {
+    const h = Number(s?.humanHours);
+    if (!s?.phase || !Number.isFinite(h) || h <= 0) continue;
+    byPhase[s.phase] = Math.round(((byPhase[s.phase] || 0) + h) * 100) / 100;
+  }
+  return { hours, byPhase };
+}
+
 function buildCost(steps, totalCostUsd) {
   const byPhase = {};
   let sum = 0;
@@ -133,6 +149,26 @@ function maxCyclePerPhase(agentSteps) {
   return out;
 }
 
+const strList = (arr) => unique(Array.isArray(arr) ? arr.filter((x) => typeof x === 'string').map((x) => cleanText(x, 120)) : []);
+
+/**
+ * `policy` (team-policy design §10): the home the run's policy came from and what the developer
+ * did about it. Absent (null) when the run saw no policy. `reason` is free text visible to the
+ * team, so it follows the branch's attribution choice: dropped under `attribution: none`.
+ */
+function buildPolicy(p, attribution) {
+  if (!p || typeof p !== 'object' || !p.home) return null;
+  return {
+    home: cleanText(p.home, 120),
+    sha: typeof p.sha === 'string' && /^[0-9a-f]{7,40}$/i.test(p.sha) ? p.sha.slice(0, 7).toLowerCase() : null,
+    overrides: strList(p.overrides),
+    exceeded: strList(p.exceeded),
+    deviations: strList(p.deviations),
+    unattended: p.unattended === true,
+    reason: attribution === 'none' ? null : cleanText(redactPaths(p.reason)),
+  };
+}
+
 /**
  * Build a v1 RunRecord from a normalized snapshot (see snapshotFromHarness).
  * @param {object} snap
@@ -162,6 +198,9 @@ export function buildRunRecord(snap, { attribution = 'git-user', now = new Date(
     endedAt: isoSec(snap.endedAt) ?? recordedAt,
     wallMs: Number.isFinite(startMs) && Number.isFinite(endMs) ? Math.max(0, endMs - startMs) : null,
     activeMs: num(snap.totalActiveMs),
+    // Parked (paused, or dead between a crash and its resume): leaves the autonomy denominator.
+    // Additive under v1; a record without it parks nothing.
+    pausedMs: num(snap.pausedMs) ?? 0,
     result,
     failure: buildFailure(snap, result, agentSteps),
     workflow: snap.workflow
@@ -192,6 +231,9 @@ export function buildRunRecord(snap, { attribution = 'git-user', now = new Date(
       deletions: num(g.deletions),
     },
     actor: attribution === 'none' ? null : cleanText(snap.actor),
+    // Present ONLY on runs that saw a policy: records of policy-less runs stay byte-identical to v1.
+    ...((p) => (p ? { policy: p } : {}))(buildPolicy(snap.policy, attribution)),
+    ...((h) => (h ? { human: h } : {}))(buildHuman(agentSteps, snap.humanHours)),
   };
 }
 
@@ -294,6 +336,7 @@ export async function snapshotFromHarness(harness, { status, error = null } = {}
     endedAt: st.updatedAt,
     totalActiveMs: st.totalActiveMs,
     totalCostUsd: st.totalCostUsd,
+    humanHours: st.humanHours,
     steps: withUiPhases(st.steps || [], st.stepper?.graph),
     subAgents: st.subAgents || [],
     workflow: {
@@ -322,6 +365,7 @@ export async function snapshotFromHarness(harness, { status, error = null } = {}
       deletions: summary ? summary.linesRemoved ?? null : null,
     },
     interventions: { questions: iv.questions | 0, pauses: iv.pauses | 0, resumes: iv.resumes | 0 },
+    pausedMs: Number.isFinite(iv.pausedMs) ? iv.pausedMs : 0,
     // _completePaused stamps iv. A stop/error that lands while a forced pause is still unwinding
     // never reaches it (pause → stop before the unwind finishes → site B), so fall back to this
     // instance's live reason; resume() clears both at rehydration (decision 2).
@@ -329,6 +373,10 @@ export async function snapshotFromHarness(harness, { status, error = null } = {}
       ? { reason: iv.lastPauseReason, detail: iv.lastPauseDetail ?? null }
       : harness.pauseReason ? { reason: harness.pauseReason, detail: harness.pauseDetail ?? null } : null,
     actor: await gitUserName(harness.projectDir),
+    // The run's policy state (pipelines.policy_state) as the gates and the resume flow left it;
+    // `unattended` is the harness's own auto flag, which the record needs even when nothing else
+    // was written (a --yes run that stayed under every cap still carries no state row).
+    policy: (() => { const p = readPolicyState(runId); return p.home ? { ...p, unattended: p.unattended === true || !!harness.auto } : null; })(),
   };
 }
 

package/src/core/metrics/sync.mjs

@@ -149,8 +149,9 @@ export async function gitUserName(dir) {
 }
 
 /** `-c` identity args for metrics commits (§4.5: git user, or Worca under attribution:none).
- *  A name without an email would make `git commit` fail, so both must be set to use the git user. */
-async function identityArgs(dir, attribution) {
+ *  A name without an email would make `git commit` fail, so both must be set to use the git user.
+ *  Exported for the team-policy branch (policy/sync.mjs), which commits under the same rules. */
+export async function identityArgs(dir, attribution) {
   if (attribution !== 'none' && await gitUserName(dir)) {
     const email = await _git(dir, ['config', 'user.email'], { timeoutMs: 10_000 });
     if (email.ok && email.stdout.trim()) return [];
@@ -446,8 +447,9 @@ async function removeWorktreeDir(dir, projectDir) {
   if (projectDir) await _git(projectDir, ['worktree', 'prune']);
 }
 
-/** Build a parentless commit holding `files` ({relPath: content}) in projectDir's object store. */
-async function orphanCommit(projectDir, files, message, attribution) {
+/** Build a parentless commit holding `files` ({relPath: content}) in projectDir's object store.
+ *  Exported for the team-policy branch (policy/sync.mjs): same orphan-branch enable recipe. */
+export async function orphanCommit(projectDir, files, message, attribution) {
   const gitDir = (await _git(projectDir, ['rev-parse', '--absolute-git-dir'])).stdout.trim();
   await mkdir(join(metricsRoot(), 'tmp'), { recursive: true });
   const stage = await mkdtemp(join(metricsRoot(), 'tmp', 'enable-'));

package/src/core/model-env.mjs

@@ -285,3 +285,152 @@ export function subagentModelIssue(v) {
   if (v == null || v === '' || isSubagentModelValue(v)) return '';
   return `unknown sub-agent model ${JSON.stringify(String(v))}`;
 }
+
+// ── model bridge: `upstream` on a catalog entry (model-bridge-design.md §6.1) ──
+// Lives in this zero-import leaf for the same reason `cost` does: the user
+// catalog (settings.mjs) and a plugin manifest (plugin-manifest.mjs) validate
+// the same shape against one rule, and neither may import the other.
+//
+//   { provider: 'copilot'|'openai'|'anthropic', api: 'anthropic'|'openai-chat',
+//     model: '<upstream id>', baseUrl?, apiKey?, headers?, capabilities? }
+//
+// A bridged entry is dispatched through worca's in-process loopback bridge
+// (src/core/bridge/): resolveModelEnv synthesizes ANTHROPIC_BASE_URL /
+// ANTHROPIC_AUTH_TOKEN / ANTHROPIC_MODEL itself, so those keys — and
+// ANTHROPIC_API_KEY, which would make the CLI prefer a first-party key — may
+// not also appear in the entry's own `env` map.
+
+export const UPSTREAM_PROVIDERS = Object.freeze(['copilot', 'openai', 'anthropic']);
+export const UPSTREAM_APIS = Object.freeze(['anthropic', 'openai-chat']);
+/** Which wire protocols each provider can be driven through. */
+export const PROVIDER_APIS = Object.freeze({
+  copilot: Object.freeze(['anthropic', 'openai-chat']),
+  openai: Object.freeze(['openai-chat']),
+  anthropic: Object.freeze(['anthropic']),
+});
+/** Env keys the bridge owns; rejected in an `env` map beside `upstream`. */
+export const BRIDGE_ROUTING_KEYS = Object.freeze([
+  'ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_MODEL',
+]);
+/** Boolean capability flags an entry may pin (model-bridge-design.md §5.6). */
+export const CAPABILITY_FLAGS = Object.freeze(['toolCalls', 'vision', 'reasoning']);
+/** Numeric capability limits an entry may pin. */
+export const CAPABILITY_LIMITS = Object.freeze(['maxPromptTokens', 'maxOutputTokens']);
+const FORBIDDEN_UPSTREAM_HEADERS = new Set(['authorization', 'host', 'content-length', 'content-type', 'transfer-encoding']);
+const HEADER_NAME_RE = /^[A-Za-z0-9-]{1,80}$/;
+
+/** Validate a `capabilities` map; returns the normalized map or undefined. Throws. */
+export function assertModelCapabilities(caps) {
+  if (caps === undefined || caps === null) return undefined;
+  if (typeof caps !== 'object' || Array.isArray(caps)) throw new Error('upstream.capabilities must be an object');
+  const out = {};
+  for (const [k, v] of Object.entries(caps)) {
+    if (CAPABILITY_FLAGS.includes(k)) {
+      if (v === null || v === undefined) continue;
+      if (typeof v !== 'boolean') throw new Error(`upstream.capabilities.${k} must be true or false`);
+      out[k] = v;
+    } else if (CAPABILITY_LIMITS.includes(k)) {
+      if (v === null || v === undefined || v === '') continue;
+      const n = Number(v);
+      if (!Number.isInteger(n) || n <= 0) throw new Error(`upstream.capabilities.${k} must be a positive integer`);
+      out[k] = n;
+    } else {
+      throw new Error(`unknown upstream.capabilities key ${JSON.stringify(k)} — allowed: ${[...CAPABILITY_FLAGS, ...CAPABILITY_LIMITS].join(', ')}`);
+    }
+  }
+  return Object.keys(out).length ? out : undefined;
+}
+
+/** Whether `v` is an acceptable http(s) base URL with no query or fragment. */
+export function isUpstreamBaseUrl(v) {
+  if (typeof v !== 'string' || !v.trim()) return false;
+  let u;
+  try { u = new URL(v.trim()); } catch { return false; }
+  return (u.protocol === 'http:' || u.protocol === 'https:') && !u.search && !u.hash;
+}
+
+/**
+ * Whether an OpenAI-compatible base URL points at this machine or a private
+ * network — llama.cpp, Ollama, LM Studio, a LAN vLLM — which typically take no
+ * API key. The bridge then treats the key as optional instead of refusing the
+ * model as "needs API key".
+ */
+export function isLocalBaseUrl(v) {
+  if (!isUpstreamBaseUrl(v)) return false;
+  const host = new URL(v.trim()).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local')) return true;
+  if (host === '::1' || /^f[cd][0-9a-f]{2}:/.test(host) || host.startsWith('fe80:')) return true;
+  const m = /^(\d+)\.(\d+)\.\d+\.\d+$/.exec(host);
+  if (!m) return false;
+  const [a, b] = [Number(m[1]), Number(m[2])];
+  return a === 127 || a === 10 || (a === 192 && b === 168) || (a === 172 && b >= 16 && b <= 31);
+}
+
+/**
+ * Validate a model `upstream` block. Returns the normalized shape or undefined
+ * (for null/undefined); THROWS on malformed input with a message naming the
+ * field. Secrets (`apiKey`) are literal strings or whole-value `${VAR}` refs.
+ * @param {*} upstream
+ * @returns {{provider:string, api:string, model:string, baseUrl?:string, apiKey?:string, headers?:Record<string,string>, capabilities?:object}|undefined}
+ * @throws {Error}
+ */
+export function assertModelUpstream(upstream) {
+  if (upstream === undefined || upstream === null) return undefined;
+  if (typeof upstream !== 'object' || Array.isArray(upstream)) throw new Error('upstream must be an object');
+  const provider = typeof upstream.provider === 'string' ? upstream.provider.trim() : '';
+  if (!UPSTREAM_PROVIDERS.includes(provider)) {
+    throw new Error(`upstream.provider must be one of ${UPSTREAM_PROVIDERS.join(' | ')}`);
+  }
+  const api = typeof upstream.api === 'string' ? upstream.api.trim() : '';
+  if (!UPSTREAM_APIS.includes(api)) throw new Error(`upstream.api must be one of ${UPSTREAM_APIS.join(' | ')}`);
+  if (!PROVIDER_APIS[provider].includes(api)) {
+    throw new Error(`provider ${provider} cannot be driven through api ${api} — allowed: ${PROVIDER_APIS[provider].join(' | ')}`);
+  }
+  const model = typeof upstream.model === 'string' ? upstream.model.trim() : '';
+  if (!model) throw new Error('upstream.model must be a non-empty string (the id the endpoint expects)');
+  const out = { provider, api, model };
+  if (upstream.baseUrl !== undefined && upstream.baseUrl !== null && upstream.baseUrl !== '') {
+    if (provider === 'copilot') throw new Error('upstream.baseUrl cannot be set for the copilot provider (the host follows the account type)');
+    if (!isUpstreamBaseUrl(upstream.baseUrl)) throw new Error('upstream.baseUrl must be an http(s) URL with no query or fragment');
+    out.baseUrl = upstream.baseUrl.trim().replace(/\/+$/, '');
+  }
+  if (upstream.apiKey !== undefined && upstream.apiKey !== null && upstream.apiKey !== '') {
+    if (provider === 'copilot') throw new Error('upstream.apiKey cannot be set for the copilot provider (sign in instead)');
+    if (typeof upstream.apiKey !== 'string' || !upstream.apiKey.trim()) throw new Error('upstream.apiKey must be a non-empty string or ${VAR}');
+    out.apiKey = upstream.apiKey.trim();
+  }
+  if (upstream.headers !== undefined && upstream.headers !== null) {
+    const h = upstream.headers;
+    if (typeof h !== 'object' || Array.isArray(h)) throw new Error('upstream.headers must be an object of string values');
+    const headers = {};
+    for (const [k, v] of Object.entries(h)) {
+      if (!HEADER_NAME_RE.test(k)) throw new Error(`upstream.headers: invalid header name ${JSON.stringify(k)}`);
+      if (FORBIDDEN_UPSTREAM_HEADERS.has(k.toLowerCase())) throw new Error(`upstream.headers: ${k} is set by the bridge and cannot be overridden`);
+      if (typeof v !== 'string' || !v.trim()) throw new Error(`upstream.headers: value for ${JSON.stringify(k)} must be a non-empty string`);
+      headers[k] = v.trim();
+    }
+    if (Object.keys(headers).length) out.headers = headers;
+  }
+  const caps = assertModelCapabilities(upstream.capabilities);
+  if (caps) out.capabilities = caps;
+  return out;
+}
+
+/** The first env key an `upstream` entry may not also carry, or null. */
+export function upstreamEnvConflict(env) {
+  for (const k of Object.keys(env || {})) if (BRIDGE_ROUTING_KEYS.includes(k)) return k;
+  return null;
+}
+
+/** Whether an `openai-chat` upstream drops the CLI's web tools (§5.3). */
+export function bridgeExcludedTools(upstream) {
+  return upstream && upstream.api === 'openai-chat' ? ['WebSearch', 'WebFetch'] : [];
+}
+
+// ── providers: account-level state shared by bridged entries (§6.2) ─────────
+export const COPILOT_ACCOUNT_TYPES = Object.freeze(['individual', 'business', 'enterprise']);
+export const DEFAULT_PROVIDER_CONCURRENCY = Object.freeze({ copilot: 4, openai: 8, anthropic: 8 });
+export const MAX_PROVIDER_CONCURRENCY = 64;
+/** Bump when the Copilot terms notice wording changes materially — a stored
+ *  acknowledgement of an older version is shown again (§8.2). */
+export const COPILOT_TERMS_VERSION = 1;

package/src/core/model-test.mjs

@@ -29,6 +29,16 @@ export function hintFor(errorClass) {
   }
 }
 
+/** Actionable hint for a bridge readiness failure (config.mjs resolveModelEnv). Pure. */
+export function bridgeHintFor(reason, provider = 'the provider') {
+  switch (reason) {
+    case 'not_signed_in': return `sign in to ${provider} under Settings › Providers (or \`worca models login ${provider}\`)`;
+    case 'terms': return 'acknowledge the GitHub Copilot notice under Settings › Providers first';
+    case 'no_key': return `set an API key for ${provider} under Settings › Providers, or on this model's Connection`;
+    default: return '';
+  }
+}
+
 /**
  * Live connectivity check for a catalog model id (global or plugin — the
  * resolution precedence is resolveModelEnv's). Explicit user action only.
@@ -71,7 +81,10 @@ export async function testModel(id, { signal, bin, run = runClaude } = {}) {
     }
     const message = err && err.message ? err.message : String(err);
     const errorClass = (err && err.errorClass) || classifyError(message);
-    const hint = hintFor(errorClass);
+    // A bridged model whose provider is not usable (model-bridge-design.md
+    // §8.5): resolveModelEnv fails fast with `bridgeReason`, and the hint
+    // names the fix instead of the generic credential advice.
+    const hint = err && err.bridgeReason ? bridgeHintFor(err.bridgeReason, err.bridgeProvider) : hintFor(errorClass);
     return { ok: false, errorClass, message, ...(hint ? { hint } : {}) };
   } finally {
     clearTimeout(timer);

package/src/core/notifications.mjs

@@ -0,0 +1,128 @@
+// src/core/notifications.mjs
+// The generic, append-only notification log (schema v31). Today only scope
+// 'schedule' is written — every scheduled-run event (missed, failed, skipped, late,
+// self-paused, completed) lands here — but the table carries a `scope` column so an
+// app-wide centre can reuse it without a second system.
+//
+// Read state is GLOBAL (Worca is single-user per machine). `info` rows arrive
+// already read: only `problem` rows count towards the unread badge. A problem
+// RESOLVES itself when the user acts on it (Run now, reschedule, resume), so stale
+// alarms never pile up.
+//
+// Sync (node:sqlite) like every other store module. Listeners registered with
+// onNotification() fire in THIS process only; a row written by another process
+// (a `--wait` CLI) is picked up by the server tick through latestNotificationId().
+
+import { getDb } from './db.mjs';
+
+export const NOTIFICATION_SEVERITIES = ['problem', 'info'];
+export const NOTIFICATION_RETENTION_DAYS = 90;
+
+const listeners = new Set();
+
+/** Subscribe to rows added in this process. Returns a disposer. */
+export function onNotification(fn) {
+  listeners.add(fn);
+  return () => listeners.delete(fn);
+}
+
+function rowToNotification(r) {
+  if (!r) return null;
+  return {
+    id: r.id,
+    scope: r.scope,
+    kind: r.kind,
+    severity: r.severity,
+    scheduleId: r.schedule_id || null,
+    ticketId: r.ticket_id || null,
+    pipelineId: r.pipeline_id || null,
+    projectDir: r.project_dir || null,
+    title: r.title || null,
+    message: r.message,
+    createdAt: r.created_at,
+    readAt: r.read_at || null,
+    resolvedAt: r.resolved_at || null,
+    unread: !r.read_at && r.severity === 'problem',
+  };
+}
+
+/**
+ * Append one notification. `info` rows are stamped read at creation.
+ * @returns {object} the stored notification
+ */
+export function addNotification({
+  scope = 'schedule', kind, severity = 'problem', scheduleId = null, ticketId = null,
+  pipelineId = null, projectDir = null, title = null, message, now = new Date(),
+}) {
+  if (!kind || !message) throw new Error('addNotification: kind and message are required');
+  const sev = NOTIFICATION_SEVERITIES.includes(severity) ? severity : 'problem';
+  const ts = now.toISOString();
+  const info = getDb().prepare(`
+    INSERT INTO notifications (scope, kind, severity, schedule_id, ticket_id, pipeline_id, project_dir, title, message, created_at, read_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(scope, kind, sev, scheduleId, ticketId, pipelineId, projectDir, title, String(message), ts, sev === 'info' ? ts : null);
+  const row = rowToNotification(getDb().prepare('SELECT * FROM notifications WHERE id = ?').get(Number(info.lastInsertRowid)));
+  for (const fn of listeners) {
+    try { fn(row); } catch { /* a listener must never break the writer */ }
+  }
+  return row;
+}
+
+/**
+ * List notifications, newest first.
+ * @param {{scope?:string, unread?:boolean, problems?:boolean, scheduleId?:string, limit?:number}} [o]
+ */
+export function listNotifications({ scope = 'schedule', unread = false, problems = false, scheduleId = null, limit = 200 } = {}) {
+  const where = ['scope = ?'];
+  const args = [scope];
+  if (unread) where.push("read_at IS NULL AND severity = 'problem'");
+  if (problems) where.push("severity = 'problem'");
+  if (scheduleId) { where.push('schedule_id = ?'); args.push(scheduleId); }
+  const lim = Math.max(1, Math.min(1000, Number(limit) || 200));
+  return getDb().prepare(`SELECT * FROM notifications WHERE ${where.join(' AND ')} ORDER BY id DESC LIMIT ${lim}`)
+    .all(...args).map(rowToNotification);
+}
+
+/** Unread PROBLEM rows in a scope — the sidebar badge. */
+export function unreadCount(scope = 'schedule') {
+  return getDb().prepare("SELECT COUNT(*) AS n FROM notifications WHERE scope = ? AND read_at IS NULL AND severity = 'problem'").get(scope).n;
+}
+
+/** Highest id in the table (0 when empty) — a cheap cross-process change probe. */
+export function latestNotificationId() {
+  return getDb().prepare('SELECT COALESCE(MAX(id), 0) AS n FROM notifications').get().n;
+}
+
+/** Mark one row read (or unread with `read:false`). @returns {boolean} whether a row changed */
+export function markRead(id, { read = true, now = new Date() } = {}) {
+  const info = getDb().prepare('UPDATE notifications SET read_at = ? WHERE id = ?').run(read ? now.toISOString() : null, Number(id));
+  return info.changes > 0;
+}
+
+/** Mark every unread row of a scope read. @returns {number} rows changed */
+export function markAllRead(scope = 'schedule', { now = new Date() } = {}) {
+  return getDb().prepare('UPDATE notifications SET read_at = ? WHERE scope = ? AND read_at IS NULL').run(now.toISOString(), scope).changes;
+}
+
+/**
+ * Resolve (and mark read) the open problems of a ticket and/or schedule — called when
+ * the user acts on them. `kinds` narrows it; omitted = every problem kind.
+ * @returns {number} rows changed
+ */
+export function resolveNotifications({ ticketId = null, scheduleId = null, kinds = null, now = new Date() } = {}) {
+  if (!ticketId && !scheduleId) return 0;
+  const where = ["severity = 'problem'", 'resolved_at IS NULL'];
+  const args = [];
+  if (ticketId) { where.push('ticket_id = ?'); args.push(ticketId); }
+  if (scheduleId) { where.push('schedule_id = ?'); args.push(scheduleId); }
+  if (Array.isArray(kinds) && kinds.length) { where.push(`kind IN (${kinds.map(() => '?').join(', ')})`); args.push(...kinds); }
+  const ts = now.toISOString();
+  return getDb().prepare(`UPDATE notifications SET resolved_at = ?, read_at = COALESCE(read_at, ?) WHERE ${where.join(' AND ')}`)
+    .run(ts, ts, ...args).changes;
+}
+
+/** Drop rows older than the retention window. @returns {number} rows removed */
+export function purgeNotifications({ days = NOTIFICATION_RETENTION_DAYS, now = new Date() } = {}) {
+  const cutoff = new Date(now.getTime() - days * 86400000).toISOString();
+  return getDb().prepare('DELETE FROM notifications WHERE created_at < ?').run(cutoff).changes;
+}

package/src/core/onboarding.mjs

@@ -12,13 +12,14 @@ import { countProjects } from './projects.mjs';
 import { countWorkspaces } from './workspaces.mjs';
 import { countThreads } from './ask/store.mjs';
 import { listScopes } from './metrics/read.mjs';
+import { listPolicyScopes } from './policy/sync.mjs';
 import { explainUnspawnableClaude, resolveClaudeBin } from './preflight.mjs';
 import { onboardingPrefs } from './settings.mjs';
 
 /** Step ids in shelf order. The UI (ui/public/getting-started.mjs) carries the
  *  copy and artwork for each; this list is the contract between the two. */
 export const ONBOARDING_STEPS = Object.freeze([
-  'claude', 'project', 'run', 'ask', 'workflows', 'realRun', 'workspace', 'teamMetrics',
+  'claude', 'project', 'run', 'ask', 'realRun', 'workflows', 'workspace', 'teamMetrics', 'teamPolicy',
 ]);
 
 /** The configured Claude binary — the same precedence claude-runner.mjs spawns with. */
@@ -69,7 +70,7 @@ export function claudeReady(bin = configuredClaudeBin(), opts = {}) {
 }
 
 /**
- * The eight ticks plus the two stored flags, in one call.
+ * The nine ticks plus the two stored flags, in one call.
  * @returns {Promise<{steps:Record<string,boolean>, done:number, total:number,
  *   claude:{bin:string, hint:string|null}, hidden:boolean, welcomeSeen:boolean}>}
  */
@@ -81,6 +82,10 @@ export async function onboardingStatus() {
   // Cached status only (no discovery): this is read at boot and after every change
   // broadcast, and the Team metrics page owns the expensive refresh.
   try { teamMetrics = !!(await listScopes()).anyEnabled; } catch { /* offline / no git: not enabled */ }
+  // Same for the policy: a project or workspace that RESOLVES a policy (its own home or one it
+  // follows) from the cached branch reads — never a discovery.
+  let teamPolicy = false;
+  try { teamPolicy = !!(await listPolicyScopes()).anyEnabled; } catch { /* offline / no git: not enabled */ }
   const steps = {
     claude: claude.ready,
     project: countProjects() > 0,
@@ -93,6 +98,7 @@ export async function onboardingStatus() {
     workflows: count("SELECT COUNT(*) AS n FROM project_config WHERE active_workflow_id IS NOT NULL AND TRIM(active_workflow_id) != ''") > 0,
     workspace: countWorkspaces() > 0,
     teamMetrics,
+    teamPolicy,
   };
   const done = ONBOARDING_STEPS.filter((id) => steps[id]).length;
   return { steps, done, total: ONBOARDING_STEPS.length, claude: { bin: claude.bin, hint: claude.hint }, ...onboardingPrefs() };