@worca/app 1.5.0 → 1.6.0-rc.1

package/src/core/metrics/sync.mjs

@@ -89,7 +89,8 @@ async function defaultGit(cwd, args, { timeoutMs = 60_000, env = null } = {}) {
   // Local commands (commit, worktree, read-tree…) get no credential at all.
   let base;
   if (NETWORK_GIT.has(args[0])) {
-    const cred = await githubEnv('write', { repo: await originRepo(cwd) });
+    // Team data, not a person's work: always worca's own credential, never "push as me".
+    const cred = await githubEnv('write', { repo: await originRepo(cwd), asPerson: false });
     if (cred.error) console.warn(`[worca] metrics/policy git ${args[0]}: ${cred.error}`);
     base = cred.env;
   } else {

package/src/core/model-env.mjs

@@ -406,6 +406,73 @@ export function isLocalBaseUrl(v) {
   return a === 127 || a === 10 || (a === 192 && b === 168) || (a === 172 && b >= 16 && b <= 31);
 }
 
+/**
+ * Whether a base URL is OpenRouter's (openrouter.ai or a subdomain). The
+ * bridge then speaks OpenRouter's dialect of chat completions: usage
+ * accounting, unified `reasoning`, provider routing and attribution headers.
+ */
+export function isOpenRouterBaseUrl(v) {
+  if (!isUpstreamBaseUrl(v)) return false;
+  const host = new URL(v.trim()).hostname.toLowerCase();
+  return host === 'openrouter.ai' || host.endsWith('.openrouter.ai');
+}
+
+/** OpenRouter's provider sort orders (provider routing). */
+export const OPENROUTER_SORTS = Object.freeze(['price', 'throughput', 'latency']);
+
+/** A list of non-empty trimmed strings, or a throw naming the field. */
+function stringList(v, field) {
+  if (!Array.isArray(v)) throw new Error(`${field} must be an array of strings`);
+  const out = [];
+  for (const s of v) {
+    if (typeof s !== 'string') throw new Error(`${field} must be an array of strings`);
+    if (s.trim()) out.push(s.trim());
+  }
+  return out;
+}
+
+/**
+ * Validate an `upstream.openrouter` block — OpenRouter's request options,
+ * sent only when the entry's base URL is OpenRouter's:
+ * `{ models?: string[], provider?: { order?: string[], allow_fallbacks?: boolean, sort?: 'price'|'throughput'|'latency' } }`.
+ * `models` is the fallback list tried after the entry's own model. Returns the
+ * normalized block, or undefined when nothing is set. Throws.
+ */
+export function assertOpenRouterOptions(o) {
+  if (o === undefined || o === null) return undefined;
+  if (typeof o !== 'object' || Array.isArray(o)) throw new Error('upstream.openrouter must be an object');
+  const out = {};
+  for (const k of Object.keys(o)) {
+    if (k !== 'models' && k !== 'provider') throw new Error(`unknown upstream.openrouter key ${JSON.stringify(k)} — allowed: models, provider`);
+  }
+  if (o.models !== undefined && o.models !== null) {
+    const models = stringList(o.models, 'upstream.openrouter.models');
+    if (models.length) out.models = models;
+  }
+  const p = o.provider;
+  if (p !== undefined && p !== null) {
+    if (typeof p !== 'object' || Array.isArray(p)) throw new Error('upstream.openrouter.provider must be an object');
+    const provider = {};
+    for (const k of Object.keys(p)) {
+      if (!['order', 'allow_fallbacks', 'sort'].includes(k)) throw new Error(`unknown upstream.openrouter.provider key ${JSON.stringify(k)} — allowed: order, allow_fallbacks, sort`);
+    }
+    if (p.order !== undefined && p.order !== null) {
+      const order = stringList(p.order, 'upstream.openrouter.provider.order');
+      if (order.length) provider.order = order;
+    }
+    if (p.allow_fallbacks !== undefined && p.allow_fallbacks !== null) {
+      if (typeof p.allow_fallbacks !== 'boolean') throw new Error('upstream.openrouter.provider.allow_fallbacks must be true or false');
+      provider.allow_fallbacks = p.allow_fallbacks;
+    }
+    if (p.sort !== undefined && p.sort !== null && p.sort !== '') {
+      if (!OPENROUTER_SORTS.includes(p.sort)) throw new Error(`upstream.openrouter.provider.sort must be one of ${OPENROUTER_SORTS.join(' | ')}`);
+      provider.sort = p.sort;
+    }
+    if (Object.keys(provider).length) out.provider = provider;
+  }
+  return Object.keys(out).length ? out : undefined;
+}
+
 /**
  * Validate a model `upstream` block. Returns the normalized shape or undefined
  * (for null/undefined); THROWS on malformed input with a message naming the
@@ -453,6 +520,11 @@ export function assertModelUpstream(upstream) {
   }
   const caps = assertModelCapabilities(upstream.capabilities);
   if (caps) out.capabilities = caps;
+  if (upstream.openrouter !== undefined && upstream.openrouter !== null) {
+    if (provider !== 'openai') throw new Error('upstream.openrouter is only for the openai provider (an OpenRouter base URL)');
+    const or = assertOpenRouterOptions(upstream.openrouter);
+    if (or) out.openrouter = or;
+  }
   return out;
 }
 

package/src/core/model-test.mjs

@@ -8,7 +8,8 @@
 import { runClaude } from './claude-runner.mjs';
 import { resolveModelEnv } from './config.mjs';
 import { AUX_EFFORT } from './model-env.mjs';
-import { classifyError } from './recoverable-error.mjs';
+import { classifyError, isFreeDailyLimit, freeDailyHint } from './recoverable-error.mjs';
+import { failedBecauseSignedOut } from './claude-auth.mjs';
 import { bridgeEvents } from './bridge/telemetry.mjs';
 
 const TEST_TIMEOUT_MS = 60_000;
@@ -30,6 +31,8 @@ export function hintFor(errorClass) {
   }
 }
 
+export const CLAUDE_SIGNED_OUT_HINT = "Claude Code isn't signed in — run `claude` in a terminal and type /login";
+
 /** Actionable hint for a bridge readiness failure (config.mjs resolveModelEnv). Pure. */
 export function bridgeHintFor(reason, provider = 'the provider') {
   switch (reason) {
@@ -44,11 +47,11 @@ export function bridgeHintFor(reason, provider = 'the provider') {
  * Live connectivity check for a catalog model id (global or plugin — the
  * resolution precedence is resolveModelEnv's). Explicit user action only.
  * @param {string} id catalog model id
- * @param {{signal?:AbortSignal, bin?:string, run?:typeof runClaude}} [opts]
- *   `run` is injectable for unit tests.
+ * @param {{signal?:AbortSignal, bin?:string, run?:typeof runClaude, signedOut?:typeof failedBecauseSignedOut}} [opts]
+ *   `run` / `signedOut` are injectable for unit tests.
  * @returns {Promise<{ok:true, text:string}|{ok:false, errorClass:(string|null), message:string, hint?:string}>}
  */
-export async function testModel(id, { signal, bin, run = runClaude } = {}) {
+export async function testModel(id, { signal, bin, run = runClaude, signedOut = failedBecauseSignedOut } = {}) {
   const ctrl = new AbortController();
   const onOuterAbort = () => ctrl.abort();
   if (signal) {
@@ -81,6 +84,7 @@ export async function testModel(id, { signal, bin, run = runClaude } = {}) {
       signal: ctrl.signal,
       bin,
       onEvent: () => {},
+      spawnKind: 'test',         // credential broker: a 10-minute token (broker-client.mjs)
     });
     const reply = String(text || '').split(/\r?\n/).map((l) => l.trim()).find((l) => l) || '';
     if (!reply) {
@@ -106,8 +110,16 @@ export async function testModel(id, { signal, bin, run = runClaude } = {}) {
     // names the fix instead of the generic credential advice. A bridge failure
     // classed `network` ("endpoint unreachable", "upstream error (500)") is not
     // an ANTHROPIC_BASE_URL problem: no hint, so the UI shows the message.
+    // A signed-out CLI is not this model's token: a first-party model needs the
+    // Claude Code sign-in (and signed out the CLI may only say `unrecognized_model`),
+    // so say that instead of the generic advice.
+    const cliSignedOut = !(err && err.bridgeReason) && !bridgeFailure
+      && await signedOut({ message, model: id, ...(bin ? { bin } : {}) });
     const hint = err && err.bridgeReason ? bridgeHintFor(err.bridgeReason, err.bridgeProvider)
-      : bridgeFailure && bridgeFailure.message && errorClass === 'network' ? '' : hintFor(errorClass);
+      : bridgeFailure && bridgeFailure.message && errorClass === 'network' ? ''
+      : cliSignedOut ? CLAUDE_SIGNED_OUT_HINT
+      : isFreeDailyLimit(message) ? freeDailyHint(message)
+      : hintFor(errorClass);
     return { ok: false, errorClass, message, ...(hint ? { hint } : {}) };
   } finally {
     bridgeEvents.off('failure', onBridgeFailure);

package/src/core/onboarding.mjs

@@ -13,7 +13,7 @@ import { countWorkspaces } from './workspaces.mjs';
 import { countThreads } from './ask/store.mjs';
 import { listScopes } from './metrics/read.mjs';
 import { listPolicyScopes } from './policy/sync.mjs';
-import { explainUnspawnableClaude, resolveClaudeBin } from './preflight.mjs';
+import { explainUnspawnableClaude, probeClaudeAuth, resolveClaudeBin } from './preflight.mjs';
 import { onboardingPrefs } from './settings.mjs';
 
 /** Step ids in shelf order. The UI (ui/public/getting-started.mjs) carries the
@@ -70,14 +70,20 @@ export function claudeReady(bin = configuredClaudeBin(), opts = {}) {
 }
 
 /**
- * The nine ticks plus the two stored flags, in one call.
+ * The nine ticks plus the two stored flags, in one call. The Claude step needs
+ * the CLI found AND not signed out (`auth` is preflight's probeClaudeAuth state;
+ * 'unknown' — mock, an older CLI — never un-ticks it). `recheck` skips the
+ * probe's remembered answer (the Connect dialog's Check again).
+ * @param {{recheck?:boolean}} [opts]
  * @returns {Promise<{steps:Record<string,boolean>, done:number, total:number,
- *   claude:{bin:string, hint:string|null}, hidden:boolean, welcomeSeen:boolean}>}
+ *   claude:{bin:string, hint:string|null, auth:'signed-in'|'signed-out'|'unknown'|null},
+ *   hidden:boolean, welcomeSeen:boolean}>}
  */
-export async function onboardingStatus() {
+export async function onboardingStatus({ recheck = false } = {}) {
   const db = getDb();
   const count = (sql) => { const row = db.prepare(sql).get(); return row ? Number(row.n) : 0; };
   const claude = claudeReady();
+  const auth = claude.ready ? (await probeClaudeAuth({ bin: configuredClaudeBin(), force: recheck })).state : null;
   let teamMetrics = false;
   // Cached status only (no discovery): this is read at boot and after every change
   // broadcast, and the Team metrics page owns the expensive refresh.
@@ -87,7 +93,7 @@ export async function onboardingStatus() {
   let teamPolicy = false;
   try { teamPolicy = !!(await listPolicyScopes()).anyEnabled; } catch { /* offline / no git: not enabled */ }
   const steps = {
-    claude: claude.ready,
+    claude: claude.ready && auth !== 'signed-out',
     project: countProjects() > 0,
     run: count("SELECT COUNT(*) AS n FROM pipelines WHERE status = 'done'") > 0,
     realRun: count('SELECT COUNT(*) AS n FROM pipelines WHERE total_cost_usd > 0') > 0,
@@ -101,5 +107,5 @@ export async function onboardingStatus() {
     teamPolicy,
   };
   const done = ONBOARDING_STEPS.filter((id) => steps[id]).length;
-  return { steps, done, total: ONBOARDING_STEPS.length, claude: { bin: claude.bin, hint: claude.hint }, ...onboardingPrefs() };
+  return { steps, done, total: ONBOARDING_STEPS.length, claude: { bin: claude.bin, hint: claude.hint, auth }, ...onboardingPrefs() };
 }

package/src/core/openrouter-free.mjs

@@ -0,0 +1,159 @@
+// src/core/openrouter-free.mjs
+// OpenRouter's daily allowance of `:free` requests (docs/models.md › OpenRouter): how many
+// are left today. 1000 a day on an account that bought $10 of credit, 50 below; every model
+// call is one request (each agent turn, each tool round trip, each retry), and a small
+// pipeline run takes about 90.
+//
+// OpenRouter's GET /key is the truth (free_model_daily_requests). Between readings every
+// `:free` call the bridge forwards lowers the count, and a 429 for the daily limit sets it to
+// 0; the next reading corrects any drift. A reading is kept for READ_TTL_MS.
+//
+// Whose allowance: without the credential broker, the key on Settings › Providers (one per
+// install). With the broker, each person's own key, read through the broker with a
+// short-lived token billed to them; the bridge can't tell whose key a call used there, so
+// the count refreshes more often instead of being lowered per call.
+import { createHash } from 'node:crypto';
+import { bridgeEvents } from './bridge/telemetry.mjs';
+import { openRouterKeyInfo } from './bridge/provider-ops.mjs';
+import { isOpenRouter } from './bridge/openrouter.mjs';
+import { providerConfig, resolveProviderSecret, listGlobalModels } from './settings.mjs';
+import { listPluginModels } from './plugin-models.mjs';
+import { brokerEnabled, brokerInfo, mintSpawnToken, revokeSpawnToken, slotBaseUrl } from './broker-client.mjs';
+import { isFreeDailyLimit } from './recoverable-error.mjs';
+
+const READ_TTL_MS = 5 * 60_000;
+const READ_TTL_BROKER_MS = 60_000;
+
+/** Whether an upstream (upstreamSettings shape) is an OpenRouter `:free` model. Pure. */
+export function isOpenRouterFree(us) {
+  return !!us && /:free$/i.test(String(us.model || '')) && isOpenRouter(String(us.baseUrl || ''));
+}
+
+/** A stable, non-reversible name for a key: which allowance a call spent. */
+export function keyAccount(apiKey) {
+  return apiKey ? `key:${createHash('sha256').update(String(apiKey)).digest('hex').slice(0, 16)}` : null;
+}
+
+/** The next 00:00 UTC after `now` (ms): when OpenRouter resets the daily allowance. Pure. */
+export function nextUtcMidnight(now = Date.now()) {
+  const d = new Date(now);
+  return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate() + 1);
+}
+
+/** The catalog's OpenRouter `:free` models (ids). Never throws. */
+export function freeModelIds() {
+  const openaiBase = (() => { try { return providerConfig('openai').baseUrl || ''; } catch { return ''; } })();
+  const out = [];
+  let all = [];
+  try { all = [...listGlobalModels(), ...listPluginModels()]; } catch { all = []; }
+  for (const m of all) {
+    const u = m && m.upstream;
+    if (!u || u.provider !== 'openai') continue;
+    if (isOpenRouterFree({ model: u.model, baseUrl: u.baseUrl || openaiBase })) out.push(m.id);
+  }
+  return out;
+}
+
+// account -> { used, limit, remaining, readAt, resetAt }
+const state = new Map();
+const inflight = new Map();
+
+function remember(account, info, now) {
+  const fd = info && info.freeDaily;
+  if (!fd) { state.set(account, { none: true, readAt: now }); return state.get(account); }
+  const s = { used: fd.used, limit: fd.limit, remaining: fd.remaining, readAt: now, resetAt: nextUtcMidnight(now) };
+  state.set(account, s);
+  return s;
+}
+
+/** Lower an account's count by one call (a `:free` call the bridge forwarded). */
+export function tallyFreeCall(account, now = Date.now()) {
+  const s = account && state.get(account);
+  if (!s || s.none) return;
+  if (now >= s.resetAt) { state.delete(account); return; }   // a new day: the next reading says
+  s.used = Math.min(s.limit, s.used + 1);
+  s.remaining = Math.max(0, s.remaining - 1);
+}
+
+/** The daily limit was hit: nothing is left until the reset. */
+export function markFreeDailySpent(account) {
+  const s = account && state.get(account);
+  if (!s || s.none) return;
+  s.used = s.limit;
+  s.remaining = 0;
+}
+
+// The bridge's telemetry: every forwarded `:free` call lowers the count of the key it used;
+// a daily-limit refusal empties it.
+bridgeEvents.on('call', (e) => { if (e && e.free && e.account) tallyFreeCall(e.account); });
+bridgeEvents.on('failure', (e) => { if (e && e.account && isFreeDailyLimit(e.message)) markFreeDailySpent(e.account); });
+
+/** Which allowance `person` spends from, and how to read it: {account, read:(fetch)=>info}. */
+async function source(person) {
+  if (brokerEnabled()) {
+    const info = await brokerInfo();
+    const who = info.mode === 'multi' ? person : 'local';
+    if (!who || who === 'local' && info.mode === 'multi') return null;
+    const base = slotBaseUrl('openrouter');
+    if (!base || !(info.slots || []).some((s) => s.id === 'openrouter')) return null;
+    return {
+      account: `person:${who}`,
+      ttl: READ_TTL_BROKER_MS,
+      read: async (f) => {
+        const minted = await mintSpawnToken({ billTo: who, slots: ['openrouter'], kind: 'aux' });
+        try { return await openRouterKeyInfo(`${base}/api/v1`, minted.token, { fetch: f }); } finally { revokeSpawnToken(minted.spawnId); }
+      },
+    };
+  }
+  const cfg = providerConfig('openai');
+  const base = String(cfg.baseUrl || '').replace(/\/+$/, '');
+  const key = resolveProviderSecret(cfg.apiKey);
+  if (!isOpenRouter(base) || !key) return null;
+  return { account: keyAccount(key), ttl: READ_TTL_MS, read: (f) => openRouterKeyInfo(base, key, { fetch: f }) };
+}
+
+/**
+ * Today's free-model allowance for `person` (the signed-in viewer; ignored without the broker).
+ * `models`: the catalog's OpenRouter `:free` model ids (the new-run form checks its nodes against them).
+ * @returns {Promise<{enabled:false}|{enabled:true, known:false, models:string[], reason?:string}|
+ *   {enabled:true, known:true, models:string[], used:number, limit:number, remaining:number, resetAt:string, readAt:string}>}
+ */
+export async function freeDailyStatus({ person = null, force = false, fetch: f = globalThis.fetch, now = Date.now } = {}) {
+  const models = freeModelIds();
+  if (!models.length) return { enabled: false };
+  let src;
+  try { src = await source(person); } catch (err) { return { enabled: true, known: false, models, reason: err.message }; }
+  if (!src) return { enabled: true, known: false, models, reason: 'no OpenRouter key to read' };
+  let s = state.get(src.account);
+  const t = now();
+  if (force || !s || t - s.readAt > src.ttl || (s.resetAt && t >= s.resetAt)) {
+    if (!inflight.has(src.account)) {
+      inflight.set(src.account, (async () => {
+        try { return remember(src.account, await src.read(f), now()); } finally { inflight.delete(src.account); }
+      })());
+    }
+    try { s = await inflight.get(src.account); } catch { /* keep the last reading */ }
+  }
+  if (!s || s.none) return { enabled: true, known: false, models, reason: 'OpenRouter did not report a daily allowance for this key' };
+  return {
+    enabled: true, known: true, models, used: s.used, limit: s.limit, remaining: s.remaining,
+    resetAt: new Date(s.resetAt).toISOString(), readAt: new Date(s.readAt).toISOString(),
+  };
+}
+
+/** The last reading for `person`'s allowance, without a network call: {used, limit} or {}. */
+export function cachedFreeDailyCounts(person = null) {
+  let account = null;
+  if (brokerEnabled()) account = person ? `person:${person}` : 'person:local';
+  else {
+    try {
+      const cfg = providerConfig('openai');
+      if (isOpenRouter(String(cfg.baseUrl || ''))) account = keyAccount(resolveProviderSecret(cfg.apiKey));
+    } catch { account = null; }
+  }
+  const s = account && state.get(account);
+  return s && !s.none ? { used: s.used, limit: s.limit } : {};
+}
+
+/** Test hook. */
+export function _resetFreeDaily() { state.clear(); inflight.clear(); }

package/src/core/orchestrator.mjs

@@ -36,12 +36,15 @@ import { humanEstimateOverrides, memoryDefragModel } from './settings.mjs';
 import { renderPromptArtifact } from './phases.mjs';
 import { listModels, modelHasBaseUrlRouting, resolveRunConfig } from './config.mjs';
 import { resolveDefragModel, agentPairText } from './memory-defrag-model.mjs';
-import { assembleShape, ShapeError } from '../shared/graph/assemble.mjs';
+import { assembleShape, normalizeShape, ShapeError } from '../shared/graph/assemble.mjs';
+import { RECIPE_SHAPES } from './auto/recipes.mjs';
 import { fingerprintProject } from './auto/fingerprint.mjs';
 import { classifyTask, ClassifierError } from './auto/classify.mjs';
 import { autoCandidates, findEquivalentWorkflow } from './auto/match.mjs';
 import { buildProposal, sanitizeProposalAnswer, remapTunables, mintAutoWorkflowId } from './auto/proposal.mjs';
 import { resolveAutoModel } from './auto/model.mjs';
+import { autoModelsFor } from './auto/runnable.mjs';
+import { probeClaudeAuth } from './preflight.mjs';
 import {
   appendAudit, writeReview, reviewKindOf, writeDecomposition, updateTaskStatus,
   updatePhaseStatus, writeStepQuestions, readStepQuestions,
@@ -49,6 +52,7 @@ import {
 import { readAskFile } from './protocol.mjs';
 import { prepareFormAsk, formAnswerValidator, downgradeQuestion } from './ask-forms.mjs';
 import { classifyError } from './recoverable-error.mjs';
+import { withRecoveryRetry, RETRYABLE_CLASSES, HELPER_RETRY_ATTEMPTS } from './recovery-backoff.mjs';
 import { resolveFailure, markTerminal, isTerminal } from './failure-policy.mjs';
 import { byActor } from './identity.mjs';
 
@@ -97,6 +101,9 @@ export class GraphOrchestrator extends RunHarness {
     // `classify` is the test seam.
     this._auto = { feedback: [], round: 0, prior: null, costUsd: 0, pending: null };
     this._classify = typeof opts?.classify === 'function' ? opts.classify : null;
+    // Whether Claude Code is signed in decides which models Auto may design with
+    // (auto/runnable.mjs). `claudeAuth` is the test seam.
+    this._claudeAuth = typeof opts?.claudeAuth === 'function' ? opts.claudeAuth : () => probeClaudeAuth({ bin: this.claude.bin || undefined });
     Object.assign(this.state, {
       engine: 2,
       active: [],                // [{nodeId, executionId}]
@@ -170,7 +177,7 @@ export class GraphOrchestrator extends RunHarness {
    * @returns {Promise<{pair: ({model:string, effort:(string|null)}|null), warning: (string|null)}>}
    */
   async _defragAgentPair() {
-    const explicit = { model: this.claude.model, effort: this.opts.claude?.effort };
+    const explicit = { model: this.claude.model, effort: this.claude.effort };
     const stored = memoryDefragModel();
     // The catalog read only when the setting is the one that decides.
     const models = !(typeof explicit.model === 'string' && explicit.model.trim()) && stored.model
@@ -233,7 +240,14 @@ export class GraphOrchestrator extends RunHarness {
 
   async _decideTopologyInner() {
     const registry = this.registry;
-    const models = await listModels(this.projectDir);
+    // Only models this install can run (auto/runnable.mjs): signed out, a first-party pick —
+    // or the CLI default a stage without a model falls back to — dies at its first spawn.
+    let auth = 'unknown';
+    try { auth = (await this._claudeAuth())?.state || 'unknown'; } catch { /* unknown narrows nothing */ }
+    const runnable = autoModelsFor(await listModels(this.projectDir), { auth, routed: modelHasBaseUrlRouting });
+    const models = runnable.models;
+    const requireModel = runnable.requireModel;
+    if (runnable.note) this._log('orchestrator', requireModel ? 'info' : 'warn', `auto: ${runnable.note}`);
     const model = resolveAutoModel(models);
     const fingerprint = await fingerprintProject(this.projectDir);
     this._log('orchestrator', 'info', `auto: fingerprint ${Buffer.byteLength(fingerprint, 'utf8')} B`);
@@ -260,11 +274,11 @@ export class GraphOrchestrator extends RunHarness {
       } else {
         this._auto.round += 1;
         round = this._auto.round;
-        classifyFor = classify;
+        classifyFor = (input) => this._classifyWithRetry(classify, input);
       }
       let outcome;
       try {
-        outcome = await this._autoRound({ registry, models, model, fingerprint, extras, taskText, classify: classifyFor, round });
+        outcome = await this._autoRound({ registry, models, requireModel, model, fingerprint, extras, taskText, classify: classifyFor, round });
       } catch (err) {
         if (isAbort(err) || isPause(err)) throw err;
         if (pending && err instanceof ShapeError) {
@@ -274,6 +288,13 @@ export class GraphOrchestrator extends RunHarness {
           this._auto.pending = null;
           continue;
         }
+        if (err instanceof ClassifierError && !pending && RETRYABLE_CLASSES.includes(classifyError(err))) {
+          // A provider 429 / dropped connection that outlasted _classifyWithRetry says
+          // nothing about the task: run the default workflow rather than park a run
+          // that has not started. Only a transient cause falls back — an unusable reply
+          // or a timeout keeps the D17 pause below.
+          return await this._autoFallbackDefault({ err, registry, round, nodeModel: requireModel ? model : null });
+        }
         if (err instanceof ClassifierError || err instanceof ShapeError) {
           // spec D17 / §5.6: the shell's failure policy parks the run (setup site ⇒
           // pause, reason 'error', detail = the message) and the resume point keeps
@@ -318,9 +339,9 @@ export class GraphOrchestrator extends RunHarness {
   }
 
   /** One round: classifier call (one assembler-driven retry), match, proposal. */
-  async _autoRound({ registry, models, model, fingerprint, extras, taskText, classify, round }) {
+  async _autoRound({ registry, models, requireModel = false, model, fingerprint, extras, taskText, classify, round }) {
     const input = {
-      taskText, extras, fingerprint, models, registry,
+      taskText, extras, fingerprint, models, requireModel, registry,
       domain: 'coding',                                // the domain the assembler stamps: coding + shared + general agents are offered
       humanInLoop: this.humanInLoop, feedback: [...this._auto.feedback], priorShape: this._auto.prior,
       // D6 amendment (2026-09-07): the classifier may Grep/Glob/Read the RUN'S OWN checkout to
@@ -408,8 +429,9 @@ export class GraphOrchestrator extends RunHarness {
     return raw && raw.decision ? raw : validate(raw);   // auto mode answers { decision: 'accept' } without the validator
   }
 
-  /** Reuse the twin or save a new row, resolve it with the accepted tunables as the ONLY overlay, re-stamp the manifest. */
-  async _autoAdopt({ template, match, tunables, shape, answer, registry, round }) {
+  /** Reuse the twin or save a new row, resolve it with the accepted tunables as the ONLY overlay, re-stamp the manifest.
+   *  `fallback` = the classifier failure a default-workflow fallback adopts in place of a proposal (_autoFallbackDefault). */
+  async _autoAdopt({ template, match, tunables, shape, answer, registry, round, fallback = null }) {
     const name = answer.name || shape.name;
     if (!match) {
       // B3: the twin search ran at proposal time; another Auto run, the composer or the chat may
@@ -450,7 +472,10 @@ export class GraphOrchestrator extends RunHarness {
     const manifest = buildGraphManifest(this.resolved.template, this.resolved.agentsByKey, {
       overlays: { nodes: this.resolved.nodeCtx, wires: this.resolved.wires }, scripts: this.resolved.scriptsByKey,
     });
-    manifest.auto = { status: 'decided', via, rounds: round, humanInLoop: this.humanInLoop, workflowId };
+    // A fallback records what it saved (`saved`) and why (`reason`) beside via 'fallback'.
+    manifest.auto = fallback
+      ? { status: 'decided', via: 'fallback', saved: via, reason: fallback, rounds: round, humanInLoop: this.humanInLoop, workflowId }
+      : { status: 'decided', via, rounds: round, humanInLoop: this.humanInLoop, workflowId };
     this._preflightAgentKeys(this.resolved.agentKeys);
     this._preflightScriptKeys(this.resolved.scriptKeys);
     await this._preflightScriptRuntimes();
@@ -467,11 +492,69 @@ export class GraphOrchestrator extends RunHarness {
     this.state.resumePoint = null;                  // decided: the engine's onSnapshot owns the point from here
     this._emit('state', this.getState());
     await this._persist();
-    this._log('orchestrator', 'info', `auto: accepted → "${name}" (${workflowId}, ${via})`);
-    await appendAudit(this.pipeline.dir, `Auto workflow: **${name}** — ${via === 'reused' ? `reusing saved workflow ${workflowId}` : `saved as ${workflowId}`}.`).catch(() => {});
+    if (fallback) {
+      await appendAudit(this.pipeline.dir, `Auto workflow: the classifier was unreachable (${fallback}) — running the default workflow **${name}** (${via === 'reused' ? `saved workflow ${workflowId}` : `saved as ${workflowId}`}).`).catch(() => {});
+    } else {
+      this._log('orchestrator', 'info', `auto: accepted → "${name}" (${workflowId}, ${via})`);
+      await appendAudit(this.pipeline.dir, `Auto workflow: **${name}** — ${via === 'reused' ? `reusing saved workflow ${workflowId}` : `saved as ${workflowId}`}.`).catch(() => {});
+    }
     return { manifest, agentKeys: new Set(this.resolved.agentKeys), workflow: { id: workflowId, name: this.resolved.template.name || name } };
   }
 
+  /**
+   * The Auto classifier call with the shared recovery backoff (recovery-backoff.mjs):
+   * a rate_limit / network failure — a provider 429 the CLI already retried, a dropped
+   * connection — is retried before the round gives up. What the failed attempts spent
+   * rides the result (or the final error), so the round books it once (D14).
+   */
+  async _classifyWithRetry(classify, input) {
+    let spent = 0;
+    try {
+      const res = await withRecoveryRetry(() => classify(input), {
+        signal: input.signal,
+        onRetry: ({ attempt, cls, delayMs, err }) => {
+          spent += Number(err?.costUsd) || 0;
+          this._log('orchestrator', 'warn',
+            `auto: classifier ${cls} — retrying in ${Math.round(delayMs / 100) / 10}s (retry ${attempt}/${HELPER_RETRY_ATTEMPTS}): ${firstLine(err?.detail || err?.message)}`);
+        },
+      });
+      if (spent) res.costUsd = (Number(res.costUsd) || 0) + spent;
+      return res;
+    } catch (err) {
+      if (spent && err && typeof err === 'object') err.costUsd = (Number(err.costUsd) || 0) + spent;
+      throw err;
+    }
+  }
+
+  /** The classifier stayed unreachable (a transient class after its retries): run the
+   *  default workflow — adopted like an accepted proposal, so it is saying why in the run
+   *  log, the audit and the manifest (auto.via 'fallback') — instead of parking a run
+   *  that has not started. With a human in the loop that is the standard recipe, whose
+   *  exact twin is the built-in Default (wf_default); with nobody in the loop it is the
+   *  same recipe without Clarify, because spec D3 forbids stopping the run to ask. */
+  async _autoFallbackDefault({ err, registry, round, nodeModel = null }) {
+    const cause = firstLine(err?.detail || err?.message);
+    const cls = classifyError(err);
+    const recipe = RECIPE_SHAPES.find((r) => r.id === (this.humanInLoop ? 'prompt' : 'plan-partial'));
+    const assembled = assembleShape(normalizeShape(jsonClone(recipe.shape)), { registry, humanInLoop: this.humanInLoop });
+    // Signed out (auto/runnable.mjs), the recipe's nodes have no model to fall back to: run
+    // every one on the model Auto itself runs on — routed by construction.
+    if (nodeModel) {
+      for (const n of assembled.template.nodes || []) {
+        if (n.kind === 'agent') assembled.tunables[n.id] = { ...(assembled.tunables[n.id] || {}), model: nodeModel, effort: '' };
+      }
+    }
+    const match = findEquivalentWorkflow(assembled.template, await autoCandidates());
+    this._log('orchestrator', 'warn',
+      `auto: the workflow classifier failed (${cls}) after ${HELPER_RETRY_ATTEMPTS} retries — running the default workflow "${match ? match.candidate.name : assembled.shape.name}" instead: ${cause}`);
+    return this._autoAdopt({
+      template: match ? match.candidate : assembled.template, match,
+      tunables: match ? remapTunables(assembled.tunables, match.nodeMap) : assembled.tunables,
+      shape: assembled.shape, answer: { decision: 'accept', name: assembled.shape.name, nodes: {} },
+      registry, round, fallback: `${cls}: ${cause}`,
+    });
+  }
+
   /** Attached files as the classifier sees them: names, plus the first 2 KB of text files. */
   async _autoExtras() {
     const out = [];
@@ -752,6 +835,11 @@ export class GraphOrchestrator extends RunHarness {
       // advance it), so a resume credits the paused execution's pre-pause work at its terminal.
       humanCursor: this._humanCursorReady ? (this._humanCursor ?? { files: 0, insertions: 0, deletions: 0 }) : null,
       stepModels: this.stepModels,
+      // The run-level model the run was started with (restored by the harness
+      // constructor); only the fields that are set, so an older reader sees none.
+      ...(this.claude.model || this.claude.effort
+        ? { claude: { ...(this.claude.model ? { model: this.claude.model } : {}), ...(this.claude.effort ? { effort: this.claude.effort } : {}) } }
+        : {}),
       workflowId: this.workflowId,
       // Auto workflow: the decision state while UNDECIDED (spec §5.6); null once
       // the graph is adopted (workflowId is then the real id) and on saved workflows.

package/src/core/policy/effective.mjs

@@ -4,6 +4,7 @@
 // snapshot of local settings comes from policy/local.mjs, the document from policy/sync.mjs.
 
 import { FIELDS, effectiveKind, tierRank, semverAtLeast } from './registry.mjs';
+import { capDomainList } from '../web-allowlist.mjs';
 
 /**
  * The team entries that apply to ONE run kind: `workspaceRuns` replaces `fields` for
@@ -45,6 +46,14 @@ export function effectiveDefault({ local = null, team = null } = {}) {
   return { value: local ? local.value : null, source: local ? 'default' : 'none' };
 }
 
+/** Ask web access on/off: only the developer switches it on; a team value can only switch it off. */
+export function effectiveWebEnabled({ local = null, team = null } = {}) {
+  if (team && team.value === false) return false;
+  return !!(local && local.value === true);
+}
+/** The Ask web allowlist: the developer's own list, capped by the team's when the policy sets one. */
+export function capWebDomains(local, team) { return capDomainList(local, Array.isArray(team) ? team : null); }
+
 const fmtUsd = (n) => `$${Number(n).toFixed(2)}`;
 // Built-in guardrail ids render as their display names everywhere (`secure` shows as "Strict",
 // the guardrail-store.mjs BUILTIN_META rule); a policy set reads "gp:<id>".
@@ -75,7 +84,15 @@ export function effectiveRows({ doc = null, workspaceRun = false, local = {} } =
     const t = team[meta.key] || null;
     const l = local[meta.key] || null;
     let effective; let note = null;
-    if (meta.cap) {
+    if (meta.key === 'ask.webEnabled') {
+      const v = effectiveWebEnabled({ local: l, team: t });
+      effective = { value: v, display: fmtValue(meta, v), source: t && t.value === false ? 'team' : 'local' };
+    } else if (meta.key === 'ask.webAllowedDomains') {
+      const v = capWebDomains(l?.value, t?.value);
+      effective = { value: v, display: fmtValue(meta, v), source: t ? 'team' : 'local' };
+      const dropped = (Array.isArray(l?.value) ? l.value.length : 0) - v.length;
+      if (t && dropped > 0) note = `${dropped} of yours ${dropped === 1 ? 'is' : 'are'} outside the team list`;
+    } else if (meta.cap) {
       const r = effectiveCap({ local: l?.set ? l.value : null, team: t });
       effective = { value: r.cap, display: fmtValue(meta, r.cap), source: r.binding || 'none' };
       if (r.binding === 'team' && l?.set && l.value > t.value) note = `yours (${fmtUsd(l.value)}) is looser; the team cap applies`;

package/src/core/policy/local.mjs

@@ -6,7 +6,7 @@
 
 import { createRequire } from 'node:module';
 import {
-  readSettings, pipelineCostLimitUsd, totalCostLimitUsd, costLimitResetPeriod, humanRateUsdPerHour, askMaxTurns, askMaxBudgetUsd, hideBuiltinModels,
+  readSettings, pipelineCostLimitUsd, totalCostLimitUsd, costLimitResetPeriod, humanRateUsdPerHour, askMaxTurns, askMaxBudgetUsd, hideBuiltinModels, askWeb,
 } from '../settings.mjs';
 import { readConfigRow, readTeamMetricsPrefs } from '../config.mjs';
 import { projectKey } from '../store.mjs';
@@ -27,6 +27,7 @@ const parseJson = (s, fallback) => { try { const v = JSON.parse(s); return v ??
 export function localSnapshot(projectDir = null) {
   const raw = readSettings();
   const has = (k) => raw[k] !== undefined && raw[k] !== null && raw[k] !== '';
+  const web = askWeb();
   const out = {
     'cost.pipelineLimitUsd': { value: pipelineCostLimitUsd(), set: pipelineCostLimitUsd() != null },
     'cost.totalLimitUsd': { value: totalCostLimitUsd(), set: totalCostLimitUsd() != null },
@@ -34,6 +35,8 @@ export function localSnapshot(projectDir = null) {
     'cost.humanRateUsd': { value: humanRateUsdPerHour(), set: humanRateUsdPerHour() != null },
     'ask.maxTurns': { value: askMaxTurns(), set: has('askMaxTurns') },
     'ask.maxBudgetUsd': { value: askMaxBudgetUsd(), set: raw.askMaxBudgetUsd !== undefined },   // literal null = "no cap", a choice
+    'ask.webEnabled': { value: web.enabled, set: typeof raw.askWeb?.enabled === 'boolean' },
+    'ask.webAllowedDomains': { value: web.allowedDomains, set: web.allowedDomains.length > 0 },
     'models.hideBuiltins': { value: hideBuiltinModels(), set: has('hideBuiltinModels') || raw.hideBuiltinModelsChosen === true },
     'plugins.marketplaces': { value: Object.values(readMarketplaces().marketplaces).map((m) => m.url), set: true },
     'plugins.required': { value: Object.entries(readPluginsLock()).map(([name, e]) => ({ name, version: e?.version ?? null, enabled: e?.enabled !== false })), set: true },